[liberationtech] (DRAFT) Assessing Treasury's March 2012 Interpretive Guidance and Statement of Licensing Policy

[Collin Anderson]

Libtech,

This list is not so small and private anymore, but I have always relied on
it for critical input. Below is a draft on some guidance (guidance on
guidance) that I have been developing about yesterday's sanctions policy
statement. I remain concern about the tone (and grammar), but am interested
in timeliness. I would appreciate any thoughts before I stick it in a more
public place, lest anything be scurrilous lies.

Cordially,
Collin

---

Assessing Treasury's March 2012 Interpretive Guidance and Statement of
Licensing Policy
**
While the March 2012 Department of Treasury statement of illustrative
guidance and preferred licensing policy represents a continuing and
commendable recognition by the State Department of the impediments of
sanctions policy to its Internet Freedom agenda, the actions represent
little more than a clarification of two year old authorizations and public
encouragement for private companies to live up to reasonable standards of
ethical behavior. Responsibility for progress cannot simply fall on the
State Department, Commerce or Treasury; without positive signals from
Congress and civil society, the best intention of the foreign policy
establishment will be limited by the political realities and pressures in
which the agencies exist. The fulfillment of the promises of Obama’s
address is dependent on human rights organizations and the technology
community to call on companies to make significant changes to their
internal policies. However, history shows that companies and individuals
remain averse to applying for specific licenses, opting instead to either
restrict access entirely or operate in legal ambiguity. In absence of a new
General License for commercial technologies that facilitate an unfettered
and secure Internet, the public and diaspora of embargoed countries will
continue to encounter significant obstacles for access to information.
**
Nowruz

As a part of the Obama Administration’s public diplomacy tradition of
goodwill gestures on the Persian New Year, Nowruz, the Department of
Treasury issued a document containing ‘illustrative guidance’ and a
‘statement of licensing policy’[1]. Where in the coordinated Presidential
remarks, these releases were presented as ‘new guidelines to make it easier
for American businesses to provide software and services,’[2] in actuality
they amount more to a public statement of existing policy and
authorizations that were made in March 2010. Moreover, these clarifications
do not clearly address their applicability to Treasury’s Office of Foreign
Asset Control’s other ‘comprehensive’ programs, Cuba, Sudan and Syria --
nor those of the Commerce’s Bureau of Industry and Security’s neglected
regulations toward Syria. Looking at the history of sanctions controls on
technology, these statements are clearly an endeavor by the Department of
State to the remove the ambiguity surrounding the Iran Transaction
Regulation’s (ITR) authorizations on ‘exportation of certain services and
software incident to Internet-based communications.‘

The clauses of importance in ITR §560.540[4] are those under subsection
(a), which permit:

(1) The exportation from the United States or by U.S. persons, wherever
located, to persons in Iran of services incident to the exchange of
personal communications over the Internet, such as instant messaging, chat
and email, social networking, sharing of photos and movies, web browsing,
and blogging, provided that such services are publicly available at no cost
to the user.

(2) The exportation from the United States or by U.S. persons, wherever
located, to persons in Iran of software necessary to enable the services
described in paragraph (a)(1) of this section, provided that such software
is classified as ‘‘EAR99’’ … and provided further that such software is
publicly available at no cost to the user.

As well as those that under (b), which deny:

(3) The direct or indirect exportation of Internet connectivity services or
telecommunications transmission facilities (such as satellite links or
dedicated lines).

(4) The direct or indirect exportation of web-hosting services that are for
purposes other than personal communications (e.g., web-hosting services for
commercial endeavors) or of domain name registration services.

Illustrative Guidance

While §560.540’s introduction led to a number of changes to corporate
policies, thereby increasing the availability of software to sanctioned
countries, lingering impediments remain for the public of these sanctioned
countries. Many private companies have been extremely conservative about
reinstating such services; attempts by human rights advocates,
technologists, even employees are often met with silence by corporate legal
departments. It is no surprise then, why the clarification is so explicit,
rather than §560.540(a)(1)’s legally complex definition, reading now to
permit delineated categories of services and software in an accessible
fashion:

As per Interpretative Guidance, Section II:

   - Personal Communications (e.g., Yahoo Messenger, Google Talk, Microsoft
   Live, Skype (non-fee based))
   - Updates to Personal Communications Software
   - Personal Data Storage (e.g., Dropbox)
   - Browsers/Updates (e.g., Google Chrome, Firefox, Intemet Explorer)
   - Plug-ins (e.g., Flashplayer, Shockwave, Java)
   - Document Readers (e.g., Acrobat Readers)
   - Free Mobile Apps Related to Personal Communications
   - RSS Feed Readers and Aggregators (e.g., Google Feed Burner).


What is unexpected is the note of specific software names. In previous
queries to entities at the State Department, such the International
Communications & Information Policy group and the Office of Terrorism
Finance & Sanctions Policy, the frustration of the diplomatic establishment
seemed palpable. The agency had set in place a policy designed to give
considerable leeway to vendors, and yet the technologies that are part and
parcel of the Internet Freedom agenda remained unavailable. Even Google,
with its strong links to State and Secretary Clinton, has been slow and
selective in embracing policy changes, only appearing to do so after
receiving specific licenses for the export of software such as Google Earth
and Chrome (it is unclear whether this is consistent across all OFAC
sanctioned countries and appears Syria remains blocked due to incongruent
jurisdictions with BIS)[5].

Statement of Licensing Policy

A further indicator of the intention of State to remove the ambiguity and
apprehension of private companies is the Statement of Licensing Policy
(SLP), that signals a “favorable licensing policy... to export to Iran
certain services and software not covered by section 560.540 of the ITR
that directly benefit the Iranian people.” While encouraging companies to
apply for licenses, Treasury seems to have implicitly excluded a number of
services out of the exemption, and thereby missed an opportunity to clarify
outstanding questions. Until companies begin to test the reach of the
favorable licensing policy, the fate of antivirus applications, domain
registration, SSL certificates, and more remains in doubt. As an example,
while §560.540(b)(4) proscribed ‘hosting services that are for purposes
other than personal communications,’ but left noncommercial hosting
unaddressed, these revised rules may appear less forgiving by lumping
together all hosting.

I have argued previously that exemptions on informational material have
never been limited in the commercial display of content. In addition to
‘personal communications’ authorizations, as mandated by the ‘Berman
Amendment’ expressed in §1702(a) of the International Emergency Economic
Powers Act and §560.210(c) of the ITR, sanction regimes have consistently
provided for exemptions related to the export of information and
informational materials. For example, when OFAC ruled in its guidance on
‘Substantive Enhancement of Information in Iran’ (OFAC, 030708-FACRL-IA-08)
against the provision of marketing and business consulting online services,
it did so objecting to the U.S. Person’s sale of services to Iranian
entities without meeting the ‘fully created’ criteria. However, these new
clarifications now shift of responsibility onto private companies for
applying for a specific license and meeting as-of-yet undefined
limitations, particularly regarding the handling of money.

It is an immediate and existential issue for some U.S.-based,
Persian-language media and nongovernmental organizations that they are
denied access to most major ad networks, such as Google AdSense, AdWords
and Facebook Advertising. Many online media entities maintain their
independence by relying on private, advertisement revenue to cover
operational costs. Several prominent, American-based organizations are now
facing financial difficulties after third parties terminated advertising
relationships over concerns regarding sanctions. Furthermore, advertising
does not exclusively facilitate banned economic activity, allowing
governments and civil society the ability to promote material on issues
such as democracy and women’s rights in environments where access to
information is restricted.

Whether out of fear of running afoul of Congress, attempting to mitigate
the likelihood of ‘dual use’ technologies, or an honest assessment of
current needs, the underlying point conveyed by Treasury’s SLP is 'do not
participate in any transaction that could be perceived as facilitating the
flow of money or material goods between Iran and the rest of the world.' In
so much as they can stick to that without being seen as harming activists,
they have done so and will continue to. While the SLP notes that the
enumerated services are not exhaustive, it remains clear that sanctions
will continue to unfavorably restrict a number of services, such as:


   - hardware, such as mobile phones and computers, that are necessary for
   personal communications,
   - alternative forms of communications access, such as BGAN satellite
   Internet connectivity and satellite telephony[7],
   - cryptography that overlaps with ITAR/EAR regulations.


When OFAC previously provided guidance on the American provisioning of
Internet connectivity in Iran, it did so provided that the services ‘can be
received in Iran using non-U.S. origin goods, technology and software that
may be exported to Iran by non-U.S. persons.’ It is important to note the
extraterritorial nature of sanctions policy’s “de minimis” or
“insubstantial United States content” rules[9]:

Section 560.511(a)(2)(iv) requires that in cases involving a complex
product made of a combination of goods (including software) and technology,
the aggregate value of all U.S.-origin goods (including software) and
technology contained in the foreign-made end product is less than 10% of
the total value of the foreign-made product.

Considering the reports by Iranian Student News Agency (ISNA) [8], the
majority of mobile devices entering the Iranian market arrive through the
Chabahar Free Zone, United Arab Emirates and China. Therefore, essential
components of the electronic outreach of the United States government are
fundamentally dependent on its soft-power adversary and sanction-busting
smuggling hubs.

---

Expansive policy that promotes the availability of such online services,
software, and hardware can be developed in a manner that by no means
offends the United States’ foreign policy goals of restricting the economic
or administrative functions of hostile governments. American services and
hardware present the platforms for citizens and diaspora to debate,
exchange ideas, coordinate opposition, report human rights violations, and
support women’s rights campaigns. The images originating out of areas such
as Homs, Syria and Tehran, Iran underscore the urgency of the need for
these individuals to document their struggle and secure themselves against
increasing violence and the lead up to critical elections. The actions of
the Departments of Treasury and State represent a positive movement that
deserves recognition by those interested in the use of technology to
protect freedom of expression in hostile environments, but they are only
the first in a series of coordinated steps to fulfilling such a vision.


[1]
http://www.treasury.gov/resource-center/sanctions/Programs/Documents/internet_freedom.pdf
[2]
http://www.whitehouse.gov/the-press-office/2012/03/20/remarks-president-obama-marking-nowruz
[3]
http://www.treasury.gov/resource-center/sanctions/Programs/Documents/soc_net.pdf
[4] http://www.law.cornell.edu/cfr/text/31/560/540
[5]
https://github.com/collina/Internet-Freedom-Repository/wiki/Sanctions:-Reverse-Filtering-(%D9%81%DB%8C%D9%84%D8%AA%D8%B1-%D9%85%D8%B9%DA%A9%D9%88%D8%B3-)
[6]
https://github.com/collina/Internet-Freedom-Repository/blob/master/sanctions/ofac_sanctions_applicants_2010_2011.txt
[7] http://www.treasury.gov/resource-center/sanctions/Documents/ia060603.pdf
[8] http://itna.ir/vdcdjo0x.yt0fn6a22y.html
[9] http://www.treasury.gov/resource-center/sanctions/Documents/ia207007.pdf
*
*
-- 
*Collin David Anderson*
averysmallbird.com | @cda | Washington, D.C.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.stanford.edu/pipermail/liberationtech/attachments/20120322/79bbfd35/attachment.html>