Last week the Censorship Research Center issued a press release announcing that the Office of Foreign Assets Control (“OFAC”) issued a license authorizing the export of the Center’s Haystack software to Iran. That software permits Internet surfers in Iran to circumvent controls by the Iranian government which prohibit access to certain Internet sites within Iran.

The software functions by using encryption to hide an Iranian user’s connection to Haystack’s servers by encrypting the communications with that server within innocuous communications to unblocked sites. According to Haystack, the only way for Iran to counter Haystack would be to block all Internet access.

Two things are interesting here. First, the issuance of this specific license indicates that the general license issued by OFAC back in March for “software incident to the exchange of personal communications over the Internet” is not unlimited. The Haystack software is not personal communications software although it does enable other personal communications software to operate in Iran.

Second, although the exact strength or method of encryption isn’t revealed, it has to be assumed to be fairly strong. The company describes its encryption as follows:

even if our methods were compromised, our users’ communications would be secure. We use state-of-the-art elliptic curve cryptography to ensure that these communications cannot be read. This cryptography is strong enough that the NSA trusts it to secure top-secret data, and we consider our users’ privacy to be just as important.

Chances are good based on this description that export of this software to private end-users in countries other than Iran would have required filing a request for review with the Department of Commerce and, potentially, a waiting period prior to export. The authorization of this export indicates that the current administration believes that facilitation of internet communication in Iran is sufficient to override concerns that would otherwise be present due to the software’s use of encryption.

Back in March 2009, this blog reported that Iran was skirting sanctions imposed by the Office of Foreign Assets Control (“OFAC”) on Iran’s state shipping line, the Islamic Republic of Iran Shipping Lines (“IRISL”). OFAC had sanctioned all 123 of the IRISL’s vessels, and Iran almost immediately thereafter got busy changing the names of each of its vessels. As of March 2009 the names of 45 ships had been changed.

According to this report from the Wisconsin Project on Nuclear Arms Control released on April 9, Iran continued to change the names of IRISL vessels as fast as it could paint them over, and by March of this year IRISL had changed the names of 35 more vessels, making a total of 80 re-christened, so to speak, vessels. In addition, the IRISL has been changing nominal ownership of these ships to shell companies in Malta, Germany and Hong Kong. And to further distance itself from these ships, a new management company — Soroush Sarzamin Asatir SSA — now manages the ships in IRISL’s stead.

Of course, the OFAC designation listed the unique identifiers assigned to these boats by the International Maritime Organization, and these identifying numbers can’t be changed. Still, the Wisconsin Project report frets that it may be difficult for U.S. exporters to comply now with the sanctions because the IMO number isn’t always listed in the cargo documents, the letters of credit or other associated shipping documents. Apparently, the folks at the Wisconsin Project aren’t terribly familiar with this new-fangled thing called the Internet, because a quick Google search brought me to the sight of Vesseltracker.com, where entry of one of the new names, like “Decker” for example, quickly brings up the correct IMO number, which then can be searched against OFAC’s list.

The money line from the IRISL report, however, was this:

Iran has made more of an effort to circumvent the sanctions imposed on IRISL than the United States has made to enforce them.

Ouch.

The next day, in a Wall Street Journal article on the Wisconsin Project’s report, Adam Szubin, the director of OFAC, tried to ease the sting of the Wisconsin Project’s allegations with this not very convincing response:

Szubin said his agency “deliberates carefully about the timing of its public designations,” adding, “We may choose to delay a public identification to allow for additional surveillance or to secure cooperation with foreign allies.”

Mr. Szubin also said the Iranian company’s actions signaled the sanctions were having an effect. “Since its designation [by the Treasury], IRISL has taken a number of steps to mask its commercial activities and disguise the ownership of its ships. IRISL’s attempts to deceive third parties are consistent with its past practices, and a measure of the impact that U.S. sanctions have had.”

I don’t see how additional time for surveillance comes into play here since the name changes are a matter of public record. Less convincing still is the spin that the IRISL’s evasion of the sanctions is some kind of proof of their effectiveness. It’s rather like saying that when a criminal goes fugitive it is proof that law enforcement is doing its job. But irrespective of when and how quickly OFAC gets around to getting the correct names on its list, exporters should determine and search the IMO numbers for each vessel they use to export their goods.