People required to comply [LWN.net]

People required to comply

Posted Oct 23, 2024 8:35 UTC (Wed) by farnz (subscriber, #17727)
In reply to: projects are left without maintainers by npws
Parent article: Several Russian developers lose kernel maintainership status

Per this notice from the Department of Commerce, all US citizens and people with permanent US residency, regardless of location, everyone located in the US, and all companies with a US legal entity face criminal penalties for breaking sanctions. Additionally, the US reserves the right to fine foreign entities that enable covered people to break US sanctions, and to prohibit them from trading with anyone in the USA until the fine is paid; so a Swedish bank that breaches sanctions can't then transfer money to, from, or through a US correspondent bank.

to post comments

People required to comply

Posted Oct 23, 2024 12:33 UTC (Wed) by Kamiccolo (subscriber, #95159) [Link] (1 responses)

And similar sanctions are not limited to US only.

People required to comply

Posted Oct 23, 2024 12:54 UTC (Wed) by farnz (subscriber, #17727) [Link]

I know for a fact (having been subject to them) that Russian sanctions work exactly the same way as USA sanctions do. The only difference between the two of note is the relative economic power of the two countries - I would be annoyed if I could never visit the USA again or be paid by a company that does business in the USA as well as my local country, but it doesn't hugely bother me that I'd have problems visiting Russia or being paid by a Russian business.

And that ends up being the core problem with where you locate an open-source foundation; international politics means that unless the world is at peace, you're really choosing the place whose sanctions decisions are least impactful on you, not a place from where you can ignore sanctions.

People required to comply

Posted Oct 23, 2024 14:13 UTC (Wed) by npws (subscriber, #168248) [Link] (5 responses)

Thanks for the link. That answers who is subject to these sanctions. However I also wonder which specific sanctions might be applicable to someone holding a maintainer role. Its not really a formalized position, there is no money or goods exchanged, any idea what these sanctions prohibiting these people from keeping their position might be?

People required to comply

Posted Oct 23, 2024 15:18 UTC (Wed) by Wol (subscriber, #4433) [Link]

Just a guess, but are they being paid, by a sanctioned entity, to work on the kernel? Or does it at least look like that?

Cheers,
Wol

People required to comply

Posted Oct 23, 2024 18:34 UTC (Wed) by MarcB (subscriber, #101804) [Link] (1 responses)

> However I also wonder which specific sanctions might be applicable to someone holding a maintainer role.

That really is the question. At least for EU sanctions, I do not see anything obvious. You could maybe interpret providing authenticated GIT access as "making available an economic resource". The only exemption here is for registered telecommunication providers.

But maybe US sanctions are broader.

People required to comply

Posted Oct 24, 2024 18:22 UTC (Thu) by MarcB (subscriber, #101804) [Link]

To answer myself:

US sanctions indeed appear to be broader and explicitly go both ways:
"These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person."

The last part would obviously cover maintainers, but really all contributors.

People required to comply

Posted Oct 24, 2024 23:48 UTC (Thu) by Paf (subscriber, #91811) [Link] (1 responses)

I think this specific part - Maintainer vs some other role - seems really, really fuzzy and probably comes from lawyers trying to figure out what sort of line to draw, possibly after consultation with relevant authorities. It is definitely a slightly arbitrary line that falls well short of no interaction.

People required to comply

Posted Oct 25, 2024 3:34 UTC (Fri) by olof (subscriber, #11729) [Link]

I am not a lawyer, and I am not in any way involved in any of this, but I don't see the differentiation as arbitrary myself:

A developer (or other maintainers) need to reach out and make contact with a maintainer when they are sending them code (or bug reports, etc). A developer submitting patches is posting on a public mailing list.

The direction of who is contacting who (and/or who is contacted in private vs on a public list) is possibly more relevant than whether a person is technically labeled a maintainer or contributor.