Complexity of legal problems [LWN.net]

Complexity of legal problems

Posted Feb 3, 2025 10:31 UTC (Mon) by farnz (subscriber, #17727)
In reply to: appearances matter move to switzerland by NYKevin
Parent article: The Linux Foundation on global regulations and sanctions

I also find it surprising, after actually talking to a real lawyer, that software engineers are unaware that a lot of these complex problems in law have what amounts to "no loopholes allowed" provisions, where if you do try to exploit a loophole, they can get you another way.

For example, for US sanctions, one of the "no loopholes allowed" provisions is that if anyone in the USA is involved in a breach, and the organisation as a whole is out of reach, they're personally liable for the breach to the full extent to which they're aware of it. That, in turn, means that no amount of "move the foundation" helps if there's a risk that Linus or Greg are going to be aware of the kernel breaching sanctions.

So in many respects, it's better for Linus to have the foundation in the USA, so that there's a larger entity that can take the blame for breach, than to have it in Switzerland where Linus gets personal liability if there's an issue with USA sanctions (even if Swiss sanctions rules don't apply here).

Complexity of legal problems

Posted Feb 4, 2025 2:33 UTC (Tue) by linuxrocks123 (subscriber, #34648) [Link] (8 responses)

That's just called "conspiracy", and most laws punish conspiracy. It's not the case, though, that simply being aware of a conspiracy makes you responsible for it. You have to intend to participate in it, and sometimes, depending on the state, have to take some "overt act" in furtherance of its objectives.

Complexity of legal problems

Posted Feb 4, 2025 10:33 UTC (Tue) by farnz (subscriber, #17727) [Link] (7 responses)

It's not "just" conspiracy - it's something specific in US sanctions laws that's designed to deal with the loophole of "I did not breach sanctions - I gave plans to FriendlyCo AG in an allied country with explicit instructions not to breach US sanctions, and I can't be held responsible for them breaching US sanctions". The sanctions-specific bit is quite clear that as soon as you're aware that you're sharing with someone who breaches US sanctions (even indirectly), then you're effectively counted as dealing directly with the sanctioned entity yourself.

The idea behind it is that foreign entities don't always report ownership or control to the US authorities in a clear fashion; this thus stops you having a Belizean, or Bahamian, or other non-US entity whose lines of control are hidden to the US, but which exists solely to allow a US entity to deal in sanctioned items with a sanctioned entity at arms' length. By making it a breach of sanctions if you know that the non-US entity is breaching sanctions, you make prosecuting the US entity much simpler; you show that they knew about the non-US entity's breach of sanctions, and you're done.

Complexity of legal problems

Posted Feb 4, 2025 12:35 UTC (Tue) by Wol (subscriber, #4433) [Link]

> The sanctions-specific bit is quite clear that as soon as you're aware that you're sharing with someone who breaches US sanctions (even indirectly), then you're effectively counted as dealing directly with the sanctioned entity yourself.

Okay, this is not sanctions-specific, but sounds very much like the British legal concept of "Knew or should have known". If you do something that may or may not be criminal - trespass is a classic example - the line for criminal liability is defined as "you should have known you weren't welcome". So a big sign saying "Trespassers will be prosecuted" converts a minor misdemeanor into a criminal act. And the fact that you can't read will simply be met with "well you should have asked someone what the sign said!".

Cheers,
Wol

Complexity of legal problems

Posted Feb 4, 2025 14:22 UTC (Tue) by raven667 (subscriber, #5198) [Link]

My guess is that in practice large American business has a systematized approach to *not* asking any questions that could make them aware, considering how much "woke" has turned into a pejorative, I think there is a lot of expertise in weaponized ignorance. For LF though there is little to hide behind to claim ignorance of developers employed by sanctioned entities, that information hasn't been systematically hidden from anyone, very few have put that kind of effort into masking their identity or employer.

Complexity of legal problems

Posted Feb 5, 2025 23:41 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (4 responses)

Yes, it sounds like this is for "knowingly" exporting to someone who will re-export to a sanctioned entity, not necessarily conspiring. Do you have a link to the statute?

Complexity of legal problems

Posted Feb 6, 2025 10:59 UTC (Thu) by farnz (subscriber, #17727) [Link] (3 responses)

No, because my understanding of it is based on talking to a US lawyer (I'm not in the US, but I've been employed by US companies), who gave me the explanation about sanctions. Fundamental to it is that in as far as is possible in US law, sanctions are transitive; if entity A is sanctioned, and you know that entity B deals with entity A, then entity B is also sanctioned. And note that it's not about re-exporting per-se; it's about allowing entity A to bypass sanctions by using entity B as a cut-out.

If you need the details, I suggest you talk to your US sanctions lawyer.

Complexity of legal problems

Posted Feb 6, 2025 11:34 UTC (Thu) by paulj (subscriber, #341) [Link] (2 responses)

The US' claim to universal jurisdiction, these transitive properties, and the effective (if not actual (?)) strict liability approach they take, combined with the huge grey areas left around stuff like "Can I collaborate with people I don't know 100% on patches for open-source? Can even talk to random people online?", along with current trends (not least, being intimately involved in the execution of genocide) make me think the only sensible and moral position for everyone in the rest of the world to be to "sanction" the USA and bar all interaction (inc trade) with the USA.

Complexity of legal problems

Posted Feb 6, 2025 14:34 UTC (Thu) by farnz (subscriber, #17727) [Link] (1 responses)

These transitive properties for sanctions aren't unusual globally - I know that Russian, UK, EU and Chinese rules on sanctions all have similar transitive properties and rules around liability for breaching sanctions that lead to the same huge grey areas (joys of working at more than one multinational where this stuff matters).

The only way to be safe is to limit your interactions to people you believe are in the same general jurisdiction as you, and to have citizenship or local equivalent in that jurisdiction - Indian citizens only associating with other Indian citizens, EU citizens with other EU citizens, Russians with Russians, UK citizens with UK citizens, Canadian citizens with other Canadian citizens etc. Otherwise, there's a risk that you'll hit one of the many edge cases, and get in trouble for doing something that you thought was perfectly legal, but isn't because you're hitting on your local jurisdiction's rules about international interactions.

Complexity of legal problems

Posted Feb 6, 2025 15:38 UTC (Thu) by paulj (subscriber, #341) [Link]

The other alternative, in this mad world where you may find some country somewhere decides you've broken their rules and deams you a criminal because you.... worked on writing Free Software (perhaps in collaboration with others) and you fell afoul of illiberal laws (be they ones which deem certain software illegal or ones which deem certain people as beyond the pale), is to do such work entirely anonymously. It takes care and dedication to do this, but it is possible.

There are already a good number of contributors to various projects who keep themselves anonymous. I expect we'll see this continue. Young people today seem much more conscious of online privacy and keeping a wall between their online and offline identities, than my generation - so this may come naturally.

There are also spheres of Free Software where the nature of the software strongly leads contributors to elect to be anonymous, because the nature of the software offends 1 or more governments around the world. Often, that nature being that the software gives users privacy from the government, e.g. in their communications, their data, or their financial interactions.

Governments really hate privacy. Maybe we should exercise it more.