Hacker News Reader

Comment by 1123581321 | Hacker News Reader

Generally, how far downstream does the US State Department expect companies to vet vendors for sanctions violation? Due diligence this many layers deep is expensive, especially if hostile (investigative work to proactively discover dishonest sourcing reports.) I would think it would vary by industry--e.g. animation is obviously less stringent than medical devices so would have fewer reporting and certification structures already set up. Does anyone have experience dealing with this?

View on HN

The entire chain all the way down is sanctioned, the US can and will climb up and down that chain to punish sanctions violations. A company like Disney will have to have a Sanctions Compliance Program and like any other compliance regime, there are standards, external auditors, etc. to make sure enough is being done, and "enough" can be a bit of a moving target. If you get caught having sanctioned suppliers, those standards and auditing get kicked up a notch, if you did a really bad job maybe fines or criminal charges.

There isn't ever a sense of "I'm doing enough and therefore the sanctions violations happening are no longer my fault". It's somewhat up to you to determine your risk and tailor your compliance program to address them and to adjust if you're ever wrong.

How guilty you are is a function of how good a job the state department thinks you're doing trying to avoid sanctions violations.

> How guilty you are is a function of how good a job the state department thinks you're doing trying to avoid sanctions violations.

Is the standard for this codified in clear language anywhere, or is it merely based on the whims of some federal prosecutor/judge? If I make digital watches, and I buy coin cell batteries from a supplier who buys battery precursors from a supplier who buys LiCoO2 from a manufacturer who buys lithium-rich brine from a supplier who buys lithium mining equipment from a sanctioned entity, how much of the full brunt of Uncle Sam's retribution can I expect to come crashing down on me?

Feds have 99+% conviction rate and infinite money and time, meanwhile you sit in cage and deal with frozen accounts while trying to pay your attorney. They imprisoned weev for doing arithmetic on wget'ing a public website.

Worst sin is angering the gods. I would imagine most the time theyll probably just ask nicely for you to stop, then bury you if you don't, but for political or convenient targets they seem fine going straight for the throat.

The hyperbole isn’t helping your argument here. Weev spent time brute-forcing collection of personal information which they discussed using for phishing, manipulating AT&T’s stock price, and potentially shorting the stock:

https://arstechnica.com/gadgets/2011/01/goatse-security-trol...

They were too bumbling to actually do anything that serious but being too broke to run a stock scam isn’t exactly a great character testimonial, and all of that is well outside of professional ethical boundaries in the infosec community.

Its not hyperbole, you're just using misguided rhetoric of the prosecution. Weev has escaped to Ukraine in any case, those same bumbling idiots making your argument had their conviction dropped on appeal.

His appeal was decided on a technicality over where the case was brought:

https://arstechnica.com/tech-policy/2014/04/appeals-court-re...

It’s certainly possible that a court might have found his actions did not violate the relevant laws, but that was not the case in the first trial where he had full opportunity to challenge the prosecution’s claims. You might characterize that as “misguided rhetoric” but that should be your cue to ask whether it’s really true that you understand the situation better than his real legal team.

The "real" prosecuting legal team didn't even prosecute in the right venue. That's how far off the mark they were.

The main reason the Feds’ conviction rate is so high is they’re lazy cowards who only try cases that are extremely easy to convict. It’s not that they do nothing but there are shitty incentives in place to only put cases in front of judges that are certain.

Since they are using your money to do this work, is this not what a taxpayer would want? How long are you gonna keep that gig if you are a coin flippin kind of prosecutor, and when your boss runs for whatever office, he gets crucified for wasting taxpayer money on uncertain cases?

More based on the whims of a prosecutor. Many small companies violate sanctions (usually unknowingly) and don't get prosecuted. But stick out too much, and you'll likely get hammered.

State Department will have all the docs one needs to avoid any problems. In your example, the real risk would be that the lithium mining equipment is dual-use, ie: they also use it to mine yellowcake uranium ore, or when your watch business takes off, they struggle to provide enough brine, and bring in specialists from Afghanistan, who streamline the process and who's Dari has a Tehran accent.

They can let you keep making money until it's promotion time, or an example needs to be made for an election campaign or they find out your watches seem to be the chronometer of choice of the latest insurgency.

Quite contrary I would say. An American megacorp will always know how much profit from the US sanctions it can do and get away with it. Sometimes a slap on the wrist can happen, but in general... You do want those campaign donations flowing, do you? Then there is no reason to rock the boat.

Smaller companies from other countries may not be so lucky so they may actually refrain from such activities.

Thanks; this is helpful. Looking up what sanctions compliance/export control professionals proactively do yields a ton of additional information.

So all that's required would then just be to outsource it to a bunch of companies who then outsource it and then claim you have: "no knowledge"?

You're the one outsourcing, so it's your responsibility. The entire chain.

Yes, of course, but I was asking what level of due diligence is expected to verify that the chain does not violate sanctions.

In other words, when a problem like this is discovered, the US State Department will assign more blame to the company if their attempts to avoid violating sanctions fell below a threshold; what is that threshold for the arts industry.

> Yes, of course, but I was asking what level of due diligence is expected to verify that the chain does not violate sanctions.

The same as you were employing them directly.

You should ask a qualified lawyer. No one on this forum is going to know the right answer.

Yeah, but "outsource it to a bunch of companies who then outsource it" is literally how the economy works. The most mundane product you can imagine has a network of upstream suppliers that is essentially incomprehensible in its complexity.

At some point maybe stop outsourcing and just do the work.

Boeing used to make airplanes. Now they outsource the work of "make the airplanes" and all it cost them was their reputation.

Less outsourcing, more just doing the work please.

Ok, so you expect the airline to mine the ore to make the tools needed to mine the ore needed to make the aluminum used in the packaging of the snacks they give out on board?

Think about exactly where this ends.

There is a difference between ordering specialist work (i.e. someone makes something to your exact specifications) and buying ore on a global market.

But sure, even in case of ore you have a responsibility to make sure it isn't being delved by slave labour.

Even when you “stop outsourcing and just do the work”, you’re just subtracting a ~4 bit integer from a ~16 bit integer.

Do you have to check just for the product that you're selling or for the inputs into that product?

Do you have to check that the tablets, keyboards and mice used by your employees and those of outsourcing companies were not made in North Korea? Do you have to check that the ink used on the keyboards weren't made in North Korea? Do you have to check that the coal for the power station for the keyboard factory didn't come from North Korea?

Reply on news.ycombinator.com