Archive for the ‘BIS’ Category


May

27

Are There Unknown Knowns, or Known Unknowns?


Posted by at 9:25 pm on May 27, 2009
Category: BIS

Skopje, Macedonia
ABOVE: Skopje, Macedonia

The Bureau of Industry and Security (“BIS”) just released an order fining and denying export privileges for Micei International, a retailer of guns. police equipment, digital cameras and other miscellaneous items in Skopje, Macedonia. The order, which adopted a recommended order by an administrative law judge, arose from charges that Micei aided and abetted Yuri Malinkovski, aka Yuri Montgomery, in violating an order denying Malinkovski’s export privileges. Pursuant to that order, Micei was fined $126,000 and had its export privileges denied for 5 years.

Malinkovski’s export privileges were denied in 2000 based on his conviction for unlicensed exports of stun guns to Macedonia. According to the BIS charging letter and the adminstrative law judge’s decision adopted by the order, Micei had Malinkovski negotiate the purchases of various items, including shirts and boots, for export from the United States to Micei in Skopje. Although the documents are not entirely clear on this point, it appears that the items were exported not by Malinkowski but by the vendors with whom he was negotiating on Micei’s behalf.

Micei was charged with knowing violations under section 764.2(e) of the Export Administration Regulations. The basis for the claim that these were knowing violations is, to say the least, somewhat dubious. The ALJ’s recommended order noted two bases for this finding. One was that the denial order was published in the Federal Register and that therefore knowledge of the denial order could be “imputed” to Micei. “Imputed” knowledge is a thin reed on which to base a claim of actual knowledge, particularly where knowledge is imputed to a company in Macedonia based on a Federal Register notice. I don’t think I’m going out on a limb here when I say that it seems a stretch to expect a company in Skopje, Macedonia, to subscribe to and read each word of the Federal Register to make sure it wasn’t dealing with parties whose export privileges had been denied.

The ALJ order also noted that an officer of Micei knew that Malinkowski was subject to a denial order. This is a better basis for a claim of a knowing violation, but still somewhat short of a slam dunk. Since it appears that the items were being exported by the sellers, and not by Malinkovski, there is a reasonable possibility that Micei didn’t know that Malinkowski’s actions as a purchasing agent rather than as an exporter would violate that order. To the credit of the BIS’s final order, however, the agency relied only on this statement by the Micei officer, and not on the claim that Federal Register publication could be imputed knowledge, in finding a knowing violation.

(For those of you who click through the BIS link, prepare to be a bit confused because it appears that someone at BIS shuffled the pages before scanning them.)

Permalink Comments (1)

Bookmark and Share


Copyright © 2009 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)

May

13

The Sincerest Form of Flattery?


Posted by at 7:44 pm on May 13, 2009
Category: BISDDTCOFAC

ThiefA helpful reader emailed me earlier today that some guy was so impressed with this blog that he decided to start his own site* (pdf image file of site – safe) by stealing each and every one of my posts — text, images, links and all. If you click on the link to the site, it doesn’t look exactly like it did earlier today. I utilized the geeky magic of the htaccess file to change the images on his site from the images taken from my site to a new image that I felt was a more appropriate illustration to the stolen posts. (You may need to refresh your browser when you return here to clear the alternative image from your browser’s cache.) Of course, I can’t wait to see if this post shows up on the site in question.

While poking around in the links of the site in question to see if I could figure out the identity of Export Law Blog’s new BFF, I discovered a document posted at California’s Centers for International Trade Development that reinforces my long-held belief that these state centers provide atrocious advice on export matters. My favorite bit of “advice” from these “Export FAQs” was this:

1. Do I need any special permits or approvals to start an export business in the U.S.?

The U.S. Government does not require a company to have a license or permit to engage in the import/export business. Contact your appropriate state or local city hall regarding requirements and procedures for obtaining business permits.

I think that deserves the Export “Epic Fail” award of 2009. Exporters of defense articles certainly need to register under Part 122 of the ITAR to export those items. But perhaps the author of the document said what he did because he was totally unfamiliar with the Directorate of Defense Trade Controls (“DDTC”). Although he discusses the Bureau of Industry and Security and the Office of Foreign Assets Control, there is not one reference in these “Export FAQs” to the DDTC. Oops.

UPDATE: The blogger has taken down his site and replaced them with pornography links. I’ve removed all links to the site and will link to a pdf of the file I captured yesterday.

UPDATE: More on this here.


*I’ve changed the link to the offending site to a tinyurl link in order to make sure that the site doesn’t get search engine credit for my having linked to it. Also it appears that our “friend” has two addresses for his site. One is hosted on blogbugs, a Ukrainian porn-centered blog hosting service, and can be found here (link removed). This explains why some readers haven’t been able to get on the site. So he/she has another site which uses the same porno sites nameservers but has a URL that might sneak past porn filters. That’s the URL linked in the post above. You know that the person behind the sites in questions is up to know good when he’s operating namelessly from Ukrainian porn site.

Permalink Comments (11)

Bookmark and Share


Copyright © 2009 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)

May

8

Old Hard Drives Never Die (or Even Fade Away)


Posted by at 8:43 am on May 8, 2009
Category: BISDDTC

Thermite Destruction MethondAccording to an article that appeared yesterday in the Daily Mail, a London daily, test launch procedures for Lockheed Martin’s Terminal High Altitude Area Defense (THAAD ) ground-to-air missile defense system were found on a hard drive purchased on eBay. The disk also contained security policies, blueprints of facilities and social security numbers for individual employees

The disk was purchased by British researchers as part of a research project which scrutinized 300 hard drives purchased from public sources such as computer auctions and eBay. The researchers found that Lockheed Martin may not have been alone in disposing of insufficiently sanitized hard drives. Thirty-four percent of the 300 hard drives examined had identifiable personal or company data. Among the discoveries was a hard-drive with security logs from the German Embassy in Paris.

The article cited a spokesman from Lockheed Martin who stated:

Lockheed Martin is not aware of any compromise of data related to the Terminal High Altitude Area Defense programe. Until Lockheed Martin can evaluate the hard drive in question, it is not possible to comment further on its potential contents or source.

A good point and, it should be remembered, it’s possible that the hard drive was not one disposed of by Lockheed Martin but rather was a hard-drive from an employee’s home computer, although that would raise a different set of issues.

But the point here is not really whether THAAD program details were or were not on hard disk drives, or even what steps the researchers took to recover data, but rather to ask this question: “What does your compliance program say about disposal of hard-drives that may have ITAR-controlled or ECCN-controlled data? And what steps does your company take when disposing of hard-drives? Most companies probably contract those responsibilities to third-party contractors who promise to wipe or destroy the drives, a promise that, as this case may illustrate, may not always be kept.

The National Industrial Security Procedures Operating Manual, DoD 5220.22-M (“NISPOM”), which contains DoD procedures for protection of classified data, requires that disks with such data be “sanitized” prior to disposal, but the NISPOM doesn’t provide a description of satisfactory sanitization techniques. Vendors who sell disk-wiping programs, such as this one, describe the NISPOM procedure as requiring multiple overwrites of all sectors of the drive with random data, but this appears to be a reference to a 1997 version of a separate DoD document entitled “Cleaning and Sanitization Matrix.” The January 2007 edition of that matrix stated: “Overwriting is no longer acceptable for sanitization of magnetic media; only degaussing or physical destruction.” (The matrix appears to have disappeared from the Internet; if anyone has a current link, please let me know.)

There are no standard procedures mandated by DDTC or BIS for pre-disposal sanitization of hard disks containing non-classified, but ITAR-controlled or ECCN-controlled, technical data. However, a good resource for developing these procedures is a document released by the Department of Commerce’s National Institute of Standards and Technology entitled “Guidelines for Media Sanitization.” The document indicates that encryption is not a sufficient sanitization technique and recommends various other methods, including multiple overwrites, degaussing and physical destruction.

This gives companies a variety of options. Companies that would rather be safe than sorry can destroy magnetic media, and companies that would rather be green can degauss such media. And, at a very minimum, there is no excuse for not downloading a disk-wiping program and overwriting magnetic media prior to disposal or sale if the company is not going to destroy or degauss it. My personal favorite method for destroying hard drives is blowing them up with thermite, but that might not be feasible in most corporate settings.

Permalink Comments (7)

Bookmark and Share


Copyright © 2009 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)

Apr

28

Valve Exports Lead To Massive Fine


Posted by at 7:09 pm on April 28, 2009
Category: BIS

BJ ServicesBJ Services, the Houston-based oil and gas field service provider, recently agreed to pay $800,000 to settle charges that it illegally exported certain valves without the requisite licenses from the Bureau of Industry and Security (“BIS”). The BIS investigation, and the subsequent fine, arose from a voluntary disclosure by BJ Services and serves as a potent reminder that a voluntary disclosure to BIS may well result in a substantial civil penalty.

The valves in issue were controlled by ECCN 2B350.g. Under that ECCN, a valve is controlled if the valve has a nominal size of more than 1.0 centimeter and is composed of nickel, titanium, zirconium or other specified metals, alloys or substances. (Nominal size is the size a pipe or valve is sold under; it may vary from actual size.) It can be safely said that this is an ECCN which doesn’t pose significant technical challenges in determining the appropriate classification, which might have been a factor in the hefty fine that BIS insisted on to settle the matter.

Prior to BIS’s April 14, 2005 amendment to the Export Administration Regulations, valves covered by ECCN 2B350 required licenses only for the 34 countries listed on column CB3 of the Country Chart. By the 2005 Amendment, the ECCN increased its controls to CB2 on the Country Chart, meaning that a license would be required to every country other than the 41 members of the Australia Group.

The first 33 counts in the charging letter relate to periods prior to the 2005 amendment and allege that exports to Kuwait, Kazakhstan, Libya, Saudi Arabia, and the U.A.E, all CB3-controlled destinations violate section 764.2(a) of the Export Administration Regulations. The remaining counts 34 to 67 related to exports after the amendment to ECCN 2B350 to such non-Australia Group countries such as Colombia, Mauritania, Mexico, Nigeria and Venezuela. These exports were alleged to violate section 764.2(e) which penalizes knowing export violations.

The allegations of knowing violations under 764.2(e) charged under counts 34 to 67 appear to be separate exports from those charged under counts 1-33, and, thus, don’t appear to be instances of “piling on” multiple charges for the same count in order to increase the possible penalties to be imposed. BIS’s penchant for such piling on appears to have been diminished by the statutory increase in available penalties from $11,000 to $250,000 per violation.

The settlement documents also describe the basis for BIS’s allegations that charges 34-67 represented knowing violations. According to the charging documents, the supplier of the valves had informed BJ Services that they were classified under ECCN 2B350. It is probably this factor that led the BIS to seek such a large fine even after a voluntary disclosure of the exports in question.

UPDATE: My former colleague Dan Fisher-Owens points out in the comments that BJ Services settled charges in 2005 for $142,500 arising from alleged unlicensed exports of ammonium bifluoride and a mixture containing triethanalomine. This was no doubt also a factor considered by BIS in determining settlement amount.

Permalink Comments (5)

Bookmark and Share


Copyright © 2009 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)

Apr

14

DDTC Asks NSC For Guidance on Foreign National Rules


Posted by at 10:06 pm on April 14, 2009
Category: BISDDTCDeemed Exports

NSC Meeting During the Ford AdministrationAn article (paid subscription required) in this week’s Washington Tariff & Trade Letter reports that at the Defense Trade Advisory Group (“DTAG”) meeting held on April 7, Frank Ruggiero, the Deputy Assistant Secretary of the Directorate of Defense Trade Controls (“DDTC”) announced that the agency had asked the National Security Council to review the treatment of foreign nationals under U.S. export laws. The DDTC request was sent at the end of March, but there is no current timetable for its consideration by the NSC inasmuch as the Obama administration is still putting together and organizing the new NSC.

At issue is the difference between the way the Bureau of Industry and Security (“BIS”) and DDTC treat foreign nationals with respect to approving transfer of controlled technical data to them. For example, DDTC may use the country of birth of a foreign national to deny licenses or agreements involving transfer of technical data to that individual. BIS, on the other hand, considers the individual’s current citizenship in evaluating his or her ability to receive controlled technical data regarding dual use items.

DDTC’s policy of considering country of birth has created some concern within the export community because it has been applied inconsistently and without any clear statement of applicable guidelines. In some formulations, it appears that the DDTC would automatically apply the policy to bar access to technical data by persons born in, but not citizens of, countries subject to arms embargos under section 126.1 of the International Traffic in Arms Regulations. At other times, DDTC has suggested that a case-by-case consideration would be applicable to foreign nationals born in proscribed countries, an approach that makes more sense when you consider situations such as a child of French diplomats born in China.

The policy has also drawn criticism from abroad. Human rights commissions in Canada and Australia have pointed out that the DDTC’s policy is, in effect, an illegal discrimination based on national origin. This has put U.S. contractors doing business in those countries in a difficult position since it is impossible for them to comply both with DDTC requirements and local laws.

Although a review of these issues for the purposes of achieving uniformity is laudable, DDTC’s motive in requesting that review is somewhat hard to determine. On the one hand, perhaps DDTC is looking for administrative cover to back away from its stricter rule and provide some relief from U.S. defense contractors with overseas operations. On the other hand, DDTC might simply be seeking to have its own narrower view imposed on BIS and other export agencies.

Permalink Comments (2)

Bookmark and Share


Copyright © 2009 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)