Security researchers have indicated that they have found Kim Jong Un’s pawprints all over the code used for the WannaCry ransomware, stolen from the CIA vaults by Vladimi Putin’s BFFs at WikiLeaks.  This, of course, raises the question as to whether companies that got locked out of their files by the ransomware violated the U.S. sanctions on North Korea if they paid the Bitcoin ransom to free their files.

The first part of that question that needs to be answered is whether U.S. sanctions are violated just by sending money to someone in North Korea.  You can’t answer that question by looking at OFAC’s Nork sanctions regulations, because they are woefully out of date.  The provisions in the regulations prohibit dealings with blocked parties in North Korea. But Executive Order 13722, issued on March 18, 2016, prohibits the unlicensed export of services by a United States person or from the United States to North Korea.  In OFAC’s view, sending money to North Korea is an export of financial services to that country.

So obviously a Bitcoin ransom payment, if it winds up in Kim Jong Un’s hands, is a problem for U.S. persons.   It looks like most of the ransom payments made so far came from outside the United States.   What about them?  All my readers should know that OFAC takes the position that if payments are made to sanctioned countries in U.S. Dollars, that is an export of financial services from the clearing bank in the United States to the sanctioned country.  But Bitcoin payments  don’t involve any banks.  That’s the whole point.  So no problem, right?

Not so fast.   Think about how Bitcoin and the blockchain works.  Any time a payment is made it will be reflected on the blockchain of all Bitcoin transactions and will be propagated to all computers running Bitcoin software — including a massive number of computers in the United States.

All that being said, there are a few practical roadblocks between a Bitcoin ransom payment to the Norks and an OFAC investigation.  First, the Chiquita case aside, there has been a general hesitance to go after people who pay these ransoms.   To begin with, it looks bad.   What government agency wants to go after a shipping company that pays off Somali pirates to protect their crew and property even if one or more of the pirates turns out to be an SDN?  (The most OFAC has done here has been to say that payments should not be made to SDN pirates but never explained how to figure out whether the pirate is an SDN.   Do you ask him to fax you his passport before the helicopter drops the ransom money on the deck?)

Second, there are difficulties in proving the identity of persons to whom Bitcoin payments are made.  Presumably the Norks would not have been stupid enough to establish the Bitcoin wallet or wallets using traceable IP addresses and were using clean addresses for each ransom transaction.  So the de-anonmyzing of the people receiving the Bitcoin payments would rely on vulnerabilities in TOR and methods to link multiple transactions by analyzing the blockchain itself. The various techniques do not always work but they can in certain circumstances. However, how likely is it that OFAC will engage in these analyses to track down the ultimate recipient of the ransom payments?

Bonus round:  In case you haven’t been reading the Twitter feed of the Nork news service, you will have missed this

Malnutrition wracks this generation of United States youth, fed only a diet of disgusting “avocado toast” in place of healthful foodstuffs.

— DPRK News Service (@DPRK_News) May 15, 2017

One of the problem with the Nork sanctions passed by the U.N. is that they rely on member states for their enforcement and not all member states are, well, super excited about sanctioning the Norks. We’re looking at you, China.

But it seems the Germans may also be looking the other way.  Consider the Cityhostel Berlin tucked away on the Glinkastraße, barely spitting distance from the Brandenburg Gate and, more importantly, the North Korean Embassy.  According to this article in Deutsche Welle, the Cityhostel is actually part of a large complex of buildings ceded to North Korea by the East Germans (bless their hearts) before the Berlin Wall was torn down.   They use it for their Embassy, and they rent space to the Berlin Cityhostel, which thereby provides extra income to Kim Jong Un and his nuclear program.

The problem is UN Resolution 2321 prohibits member states from allowing the Norks to use real property that they own for anything other than diplomatic or consular activities.  The German foreign ministry, when asked about this, did a creditable imitation of Baron Munchausen, with this obvious exaggeration:

We are closely monitoring potential violations of the sanctions regime imposed by the UN Security Council and, together with our partners, strictly observing the sanctions against North Korea.

Right. And I bet that the ministry also just saved itself from drowning by pulling on its hair and then, just for fun, took a ride on a cannonball.

Some of my U.S. readers are now probably wondering, besides how you can ride on a cannonball, whether they can stay at Hotel Norkschwein, I mean the Cityhostel, on their next trip to Berlin. Executive Order 13722 blocks all property of the North Korean government and, more importantly, prohibits any U.S. person from “making of any contribution or provision of funds, goods, or services by, to, or for the benefit of” the North Korean government. Certainly there is an argument that paying a hotel bill in a hotel leased from the Norks might be considered to fall within this prohibition.

The question, then, is whether the travel exemption would permit U.S. citizens to spend the night in Kim Jong Un’s little Berlin hideaway. That exemption prohibits regulation under the International Emergency Economic Powers Act (“IEEPA”), of transactions “ordinarily incident to travel to or from any country.” This would normally cover, and exempt from prohibition, paying for hotels while in Berlin. But Executive Order 13722 was also enacted pursuant to the North Korea Sanctions and Policy Enhancement Act of 2016, which means that the travel exemption in IEEPA would not apply. Nor has OFAC promulgated regulations under Executive Order 13722 which would exempt travel related transactions.

So, even if you are completely comfortable with throwing your hard-earned money into Kim Jong Un’s nuclear piggy bank, you do so at your own risk if you are a U.S. citizen.

The Washington Post reports that YouTube has removed Korean Central Television’s channel, fearing that it needed to do so to avoid breaching U.S. sanctions on North Korea. The removed channel was a Nork propaganda outlet that broadcast both unintentional comedies, such as outings by the super-sized dictator, Kim Jong Un, as well as Nork fake news broadcasts. Researchers and Nork watchers found the channel to be an invaluable resource in keeping track of what is going on North Korea, even if much of these broadcasts needed to be taken not with a grain of salt but with an entire salt mine.

Although Google is mum about why the channel was killed, the Post quotes a supposed explanation from somebody named Josh Stanton, a  blogger who appears to work for the U.S. government in his spare time.  Josh said that the reason was “YouTube and Google probably realized there was a problem with money changing hands.” Er, no, Josh.

The issue with respect to the Nork YouTube channel arises from Executive Order 13722, issued in March 2016, which prohibits exports of services to North Korea. Prior to that there were restrictions, enforced by BIS, on exports of goods to North Korea, and restrictions, enforced by OFAC, on dealing with blocked North Koreans. Providing distribution of Korean Central Television’s broadcasts over YouTube would clearly be the export of a service to North Korea in violation of Executive Order 13722.

But, and this is a big but, there is the information exception, enacted by the Berman amendment and ignored by Mr. Stanton and the Washington Post. The information exception prevents the President from prohibiting the “importation from any country … whether commercial or otherwise, regardless of format or medium of transmission, of any information.” See 50 U.S.C. § 1702(b)(3)(emphasis supplied). The italicized language is pretty much game over for the arguments by Mr. Stanton and the Post that ad money was the problem.

What would be a problem is if there were any indications (and there are not) that Google and YouTube were editing or marketing the content. OFAC has been quite clear that it does not think that such services are covered by the information exception (although it does allow those services, through various general licenses, for private individuals in sanctioned countries). If the Norks upload their nonsense and YouTube permits it to be downloaded, there is no violation of the sanctions even if somehow ad revenue makes its way back to North Korea (which itself seems doubtful).

While waiting (don’t hold your breath) for the return of Korean Central Television to YouTube, you might want to watch this riveting North Korean news broadcast showing the Dear Leader visiting an amusement park, a kitchen (with hamburgers! which he doesn’t eat!!) and a zoo.