The Office of Foreign Assets Control (“OFAC”) released on December 31 its cybersecurity regulations implementing Executive Order 13694 of April 1, 2015 (“EO 13694”), which permits the designation and blocking of individuals and companies that have engaged in “cyberenabled activities” that threaten the “national security, foreign policy, or economic health or financial stability.” Although no designations have been made under this order in the nine months since its issuance, OFAC didn’t want to pop open any New Year’s Eve bottles of champagne without pushing these regulations out the door. Since OFAC has yet to release regulations implementing Executive Order 13685, making Crimea the most sanctioned place on the face of the planet, this rush to implement an order under which no one has been designated is a bit puzzling. Low hanging fruit, I suppose.

The regulations are nothing more than the standard template regulations for blocking programs with  a prohibition of actions proscribed by the executive order, standard definitions, a provision implementing the 50 percent rule, and a few other basics. Three standard exceptions are provided authorizing (1) deduction of financial institution service charges from blocked accounts; (2) provision of certain legal services and (3) provision of unscheduled emergency medical services.

The emergency medical service exception, which appears in a number of regulations, is worthy of some further discussion. It addresses the issue of what happens in the case that a designated hacker or other blocked person is hit by drunken cab driver and is bleeding to death on the streets. A U.S. doctor happens by. Can he stanch the bleeding? In most blocking regulations this would be a problem because the regulations prohibit providing services to a person whose property and interests in property are blocked. Section 537.201(b)(1) of the Burma Sanctions, for example, contains such a provision. That provision would, on its face, prohibit the doctor from treating a blocked Burmese former junta member who was bleeding to death before his eyes. Hence the need for some kind of exception for unscheduled emergency treatment.

The new cybersecurity sanctions regulations do not directly prohibit providing services to a person blocked under those regulations but they do prohibit violating E.O. 13685 which itself has a provision prohibiting the provision of service to a person whose interest in property is blocked.  Thus the emergency medical exception is needed so that the doctor can apply a tourniquet without risking a jail sentence. Payment for these services, if they were sought, would be problematic without the exception because any payments to the doctor by the bleeding victim would have to be blocked. The cybercrime regulations would, however, permit this payment.

But, but, and there’s always a but when sanctions regulations are involved, these emergency services can only be provided in the United States. If the bleeding victim is on the streets of say, Canada, the U.S. doctor can’t perform or be paid for his services. He’d have to stand by and let the victim die. Fortunately, most doctors have bigger hearts than OFAC.

(The title of this post, by the way, refers to a naughty joke involving two famous actresses which can’t be repeated on a family-oriented blog such as this but which I hope some of you may have heard before. . . )

Permalink


Copyright © 2016 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)