appearances matter move to switzerland [LWN.net]

appearances matter move to switzerland

Posted Feb 5, 2025 23:17 UTC (Wed) by linuxrocks123 (subscriber, #34648)
In reply to: appearances matter move to switzerland by bluca
Parent article: The Linux Foundation on global regulations and sanctions

I don't have to, and I am in the US. Millions of US persons, every day, interact with other people on GitHub issues and PRs, and all they know about those people is a string of letters like "technobeaver7914".

Is "technobeaver7914" on the SDN list? They don't know. Neither does GitHub.

If people actually acted like they could be fined megabucks if they interacted with technobeaver7914 on GitHub, would that basically destroy GitHub as a platform for engaging in protected speech about software? Yes? Okay, there you go then.

And it's not just software. Take a look at https://lwn.net/Articles/1007807/ where franz talks about advice he received to a random guy named "linuxrocks123". franz has no idea who I am, and he's exporting expert advice which he received from a legal consultation to me. For all he knows, linuxrocks123 is actually some Iranian on the SDN list. I'm _NOT_, but he doesn't know that. If I were, would franz be fined megabucks?

Again, there you go. A "yes" answer to that question would completely eviscerate my right to anonymous speech and franz's right to speak at all. It would make everyone in the US too terrified to participate in GitHub, too terrified to help people on reddit.com/r/tax, too terrified to answer questions on StackOverflow, and too terrified to participate in any other online forums of any kind focused on any topic, technical or nontechnical, whether software, cars, crochet, boating, whatever.

A "yes" answer to that question would, in short, entirely destroy the Internet as a platform for speech for all US persons. Now, knowing _THAT_, do you _REALLY_ think the US court system would let the answer to that question be "yes"?

to post comments

appearances matter move to switzerland

Posted Feb 5, 2025 23:41 UTC (Wed) by bluca (subscriber, #118303) [Link] (7 responses)

Except of course the people removed from the kernel _were_ on the sanctions list, as they were employed by sanctioned companies, so nothing that you just wrote has anything to do with the matter at hand. Given you are in the US, then go ahead and set up a project and provide services to Baikal Electronics, which is on the sanctions list and is one of the affected companies, and let us know how well that goes for you.

appearances matter move to switzerland

Posted Feb 6, 2025 1:54 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link] (5 responses)

If you know you're collaborating with someone on the list, then you might have a problem. That is the situation the Linux Foundation was in. But the article makes the much stronger claim that you might have a problem if you don't verify that every single person you talk to on the Internet is not on the list, or even if you do verify that and are defrauded by a sanctioned entity.

That claim is alarmist and ridiculous.

appearances matter move to switzerland

Posted Feb 6, 2025 2:09 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link]

Actually, you're probably fine knowingly collaborating with a SDN as long as you're not trying to sell anything. But I guess the Linux Foundation didn't want to fight about that since they are kind of commercial.

If you're knowingly collaborating with a _LISTED_ _TERRORIST_, _THEN_ you are probably in trouble.

appearances matter move to switzerland

Posted Feb 6, 2025 10:14 UTC (Thu) by bluca (subscriber, #118303) [Link] (1 responses)

No, it doesn't. It's about sanctions and sanctioned entities. Once again, if you think it's "alarmist and ridicolous", just go provide services to Baikal Electronics or their employees and pretend you didn't know they are sanctioned, and let us know how that works out for you.

appearances matter move to switzerland

Posted Feb 7, 2025 0:50 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link]

No, how about you close your GitHub account and not talk to anyone without having proof of their real-world identity and checking that identity against the SDN list?

appearances matter move to switzerland

Posted Feb 6, 2025 11:48 UTC (Thu) by lunaryorn (guest, #111088) [Link] (1 responses)

The article does not claim it's about "every single person you talk to on the Internet".

The article is about a a very specific kind of talk, namely collaboration on and contribution to an open source project with significant impact. And from that angle the claim in the article is neither alarmist nor ridiculous but describes the very reality of everyone working in areas routinely impacted by US export control laws and sanctions.

That's just a fact, whether you like it or not, and from the point of view of someone who's working in such an area I sorry to have to admit that I find it increasingly hard to take your somewhat unsubstantiated comments serious.

appearances matter move to switzerland

Posted Feb 7, 2025 0:58 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link]

That's okay. You can just never send a patch over email or collaborate on a GitHub pull request without first knowing your counterparty's real name and meeting with them in person to check their passport and verify they're not actually a SDN pretending to be someone else.

You can certainly believe that the law requires that, and you won't get in trouble for believing that. You won't be _DOING_ much, but you won't get in trouble.

appearances matter move to switzerland

Posted Feb 6, 2025 11:29 UTC (Thu) by paulj (subscriber, #341) [Link]

I thought it was that (in at least some cases) they /may/ at one time have worked for a sanctioned entity, and (in at least some cases) they were simply removed on that basis - but without specific and current knowledge of their employment status.

appearances matter move to switzerland

Posted Feb 6, 2025 11:39 UTC (Thu) by lunaryorn (guest, #111088) [Link] (3 responses)

Github itself implements sanctions, see https://docs.github.com/en/site-policy/other-site-policie...

Specifically, it explicitly states to restrict availability to sanctioned entities and to use various sources to determine whether a user or organisation could possibly be subject to sanctions. Github generally knows a lot more than just the user name (such as mail addresses, payment history, commit, push, and interaction history, remote IP addresses, etc), and it does not need to come to a definite conclusion; it can already limit accounts on mere suspicion and require proof of identification (such as a valid credit card). Github also summarily blocks entire geographic regions. It used to block all of Iran, until it obtained a special license from the US government to restore services to Iran.

As such, Github exists as some kind of a walled garden where sanctioned entities are not present, and within with users can reasonably assume that other users legitimate or they'd not be on the platform in the first place. But the Linux Foundation runs its own infrastructure, and thus needs to care for this itself.

All of what you're describing in your comment literally exists in the more or less the very form; you were just lucky enough not to notice so far, because frankly, reddit discussions are not usually not a place where serious business is done, and neither are LWN comments.

But organisations doing serious business, especially in sensitive fields, will likely do their own checks for significant Github contributions or prolonged collaboration with external Github users. I know that my organisation would. It has a whole policy document about doing open source which includes regulations for accepting significant contributions which include concerns of export control and sanctions, and it's not even a US-based organisation.

And I'd like to remind you that under many jurisdiction export control and sanctions laws come with specific personal liability. Contrary to, say, financial regulations or product liability or customer safety you cannot routinely disclaim personal responsibility for violations done on behalf of your employer. Breaching sanctions or export control regulations is routinely a personal criminal offence, for which you're immediately liable, even if you did so on behalf of your employer, which is why no one is particularly keen to test the limits of these regulations in court.

appearances matter move to switzerland

Posted Feb 6, 2025 12:06 UTC (Thu) by intelfx (subscriber, #130118) [Link] (2 responses)

> [...] and it does not need to come to a definite conclusion; it can already limit accounts on mere suspicion and require proof of identification (such as a valid credit card). Github also summarily blocks entire geographic regions.

Is that supposed to be a good thing?

> As such, Github exists as some kind of a walled garden where sanctioned entities are not present, and within with users can reasonably assume that other users legitimate or they'd not be on the platform in the first place.

GitHub does this to protect its own ass, not the one of other users. If what you (and others in this thread) say about strict personal liability for breach of sanctions is true, then it's very obvious that you cannot rely on GitHub's "walled gardenness" to make any decisions in this space, so you didn't really refute what GP was saying.

GitHub and sanctions

Posted Feb 6, 2025 12:52 UTC (Thu) by farnz (subscriber, #17727) [Link]

Using GitHub provides you with a degree of protection, AIUI. You're safe if you genuinely believed that you weren't breaching sanctions - and you could argue that you believed that GitHub would be applying sanctions, therefore you assumed that you were not breaching sanctions by using GitHub.

Now, once the authorities have notified you, you'd have to stop working with sanctioned entities - but as a practical matter, the authorities get much more bang for their buck if they get the sanctioned entities blocked from all of GitHub than if they simply get your project to stop interacting with them.

appearances matter move to switzerland

Posted Feb 6, 2025 14:44 UTC (Thu) by lunaryorn (guest, #111088) [Link]

I didn't say anything about whether this was good or bad. I do have an opinion about the whole export control and sanctions thing, which - reading between the lines - probably isn't that far from yours, but I don't think my opinion is relevant. It is what it is, whether I like it or not.

Github certainly protects itself first and foremost, but in doing so, also provides reasonable protection to most individuals who casually contribute to open source projects. I for my part am quite sure that my personal activity on Github does not bear much of a risk, simply because none of my projects have any particular impact or reach, so I'm effectively off the grid: In the exceedingly unlikely case a sanctioned top terrorist used Github to contribute to one of my repositories there's a long long chain of people to be in trouble before anyone would come after me.

However, that's not the case for my employer, which would be held to a much much higher standard. If said top terrorist contributed to one of my employer's repositories my employer would definitely be in trouble, and if the repository was under my responsibility, so would I, unless I could meticulously prove that I followed my employer's regulations for export control and open source work to the very letter, and thus did all I could possibly to do avoid this situation. And as said in my previous comment, my employer does maintain quite extensive regulations around all this.