The recent addition by OFAC of two South African individuals and one company to the SDN list illustrates the perils that may face companies engaged in Internet services and commerce. OFAC designated Farhad and Junaid Dockrat, both alleged to be Al-Qaeda financiers, as Specially Designated Global Terrorists. OFAC also designated the company Sniper Africa, in which Junaid Dockrat holds a seventy-percent interest. Sniper Africa, which sells camouflage gear to hunters in South Africa, has a website, and this website is specifically cited in the OFAC designation.
The problem occurs because the domain name for the site, www.africasniper.com, was registered by Tucows, Inc., a U.S.-based domain name registrar. This registration service provided by Tucows permits Sniper Africa to reserve its website address for its own use and also provides the routing service necessary for the domain name to point to web servers designated by Sniper Africa. Typically a name is registered to an individual or company by a completely automated process that takes place over the Internet without any human intervention by the registrar.
Once a company or individual has been designated by OFAC as a Specially Designated Global Terrorist, OFAC regulations §§ 594.406 and 594.407 forbid U.S. companies from providing services, in the United States or abroad, to the designated company. Specifically the U.S. company may not provide:
legal, accounting, financial, brokering, freight forwarding, transportation, public relations, educational, or other services
The provision of domain name registration services to a designated individual appears to possibly run afoul of these prohibitions, potentially subjecting Tucows to substantial civil and criminal penalties. Nevertheless, Tucows continues to provide the domain registration services to Sniper Africa, without which the website would disappear from the face of the Internet.
Tucows provides its domain name services through resellers, but this doesn’t seem to provide a valid defense here. The whois record clearly shows that, although Tucows may be selling the services through a reseller, it is providing the services to the name registrant and not the reseller. Perhaps Tucows might find some solace in this case because the named registrant here is HQ Clothing Enterprises, although the fact that the name of the designated company, the name of the website and the website address are all Sniper Africa suggest that this might not be such a strong defense.
Another possible defense might be that provided by § 594.508 which exempts the provision of “telecommunications” services. That exemption, however, seems to cover only traditional telecommunications services, such as the provision of telephone service, rather than the provision of domain name registration services.
Notwithstanding the possibility that Tucows may have run afoul of OFAC’s Global Terrorism Sanctions regime, it is clear that Tucows is in an awkward position. Companies that provide domain name registration services are not often well-positioned to determine whether the ultimate party to whom the service is provided is on the SDN list or not. The transaction takes place completely over the Internet which provides only limited ability for the registrar to verify the identity of its customer. As the joke goes, you can be anyone you want on the Internet.