Subject: Re: [admin-discuss] IETF LLC & IETF Participation from USA-sanctioned countries

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 3 Mar 2021 22:10:37 +0000

The best list for this is [email-masked]. I will reply shortly with a response to you and that list.

Thanks
Jason

On 3/3/21, 4:33 PM, "ietf on behalf of Fernando Gont" <[email-masked] on behalf of [email-masked]> wrote:

    Folks,

    While studying the topic of diversity and inclusiveness in the IETF, the
    question arouse about what are the implications of the IETF LLC being
    registered in the USA.

    In particular, I'm concerned about the possible implications for
    participants from USA-sanctioned countries or organizations.

    I asked a few people here and there, and was referred to this document:
    https://urldefense.com/v3/__https://www.ietf.org/media/documents/IETF_LLC_OFAC_Compliance_Policy_2020-10-06.pdf__;!!CQl3mcHX2A!VSkOxyiXxuuG1uPa9USj7e3GAT2nL-D9ZpLeurEvTJzkrOjCTDqdumyOzkuZ_YU7lLlIhw$

    That document contains text such as:

    ---- cut here ----
    Meeting Registrations
    The current automated meeting registration system can continue, but at
    regular intervals, and no later than 30 days before the meeting begins,
    the list of registered participants and financial institutions
    associated with payment of registration fees must be checked (both for
    individual names and country of domicile and residence).
    ---- cut here ----

    and

    ---- cut here ----
    Action
    The IETF Executive Director will work with IETF LLC counsel to determine
    what action to take in each individual case. This may include not
    pursuing the contractual relationship, revoking the meeting
    registration, cancelling any existing contract or other action.
    ---- cut here ----

    I'm certainly not a lawyer, and hence I'd like an authoritative and
    clear explanation about what are the possible outcomes of this "OFAC
    Compliance Policy".

    For example, could it result in participants from Cuba, Iran, Myanmar,
    North Korea, Sudan or Syria being rejected their registration, and hence
    being prevented to participate in IETF meetings?

    If that were the case, I'm sure that we'd all agree that that would be
    inappropriate, discriminatory, oppressive, and ultimately unacceptable.
    I hope that that's not even a possibility.

    Could anyone please clarify this?

    P.S.: Besides sanctions on countries such as the above, there also seems
    to be a whole list of people and organizations that are
    sanctioned/banned:
    https://urldefense.com/v3/__https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists__;!!CQl3mcHX2A!VSkOxyiXxuuG1uPa9USj7e3GAT2nL-D9ZpLeurEvTJzkrOjCTDqdumyOzkuZ_YW28A79Fg$

    Thanks,
    --
    Fernando Gont
    e-mail: [email-masked] || [email-masked]
    PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 3 Mar 2021 22:16:29 +0000

Hi Fernando - I am not aware of any data to suggest that it has even been an issue. But please also bear in mind that the OFAC compliance need flows down from the Internet Society, since the IETF LLC is within the Internet Society corporate umbrella. We're of course always happy to consult with counsel if needed, but it would help to know if you have any data here.

Thanks
Jason

    Folks,

    ---- cut here ----
    Meeting Registrations
    ---- cut here ----

    and

    ---- cut here ----
    Action
    ---- cut here ----

    Thanks,

---

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 3 Mar 2021 22:19:36 +0000

I will ask the Secretariat and Executive Director to review any data they have. But in my time since the IETF LLC has formed, I have never heard of this being an issue. Do you have any data on this?

Thanks
Jason

On 3/3/21, 4:45 PM, "ietf on behalf of Keith Moore" <[email-masked] on behalf of [email-masked]> wrote:

    In addition to the clarification that Fernando asked for, I guess I'd
    like to know (vaguely) whether this has been a problem in the past,
    maybe how many people have been turned away.

    I'm guessing that there are other barriers in a similar category: do we
    have any  idea how many people haven't been able to attend meetings in
    person because of visa issues?

    And perhaps also: do we have any idea how many people have been unable
    to participate remotely due to internet censorship in the countries
    where they were located?

    (note: we don't need to try to address these problems at the moment,
    just trying to make the list of issues that limit participation
    reasonably complete.)

    On 3/3/21 4:32 PM, Fernando Gont wrote:
    > Folks,
    >
    > While studying the topic of diversity and inclusiveness in the IETF,
    > the question arouse about what are the implications of the IETF LLC
    > being registered in the USA.
    >
    > https://urldefense.com/v3/__https://www.ietf.org/media/documents/IETF_LLC_OFAC_Compliance_Policy_2020-10-06.pdf__;!!CQl3mcHX2A!Q1GNI366X53XWJ2mE3LM8RWY7VpMRPj7tJu-UFP_pCAMfN_4FX-U1L0iigqlgWNb2MaQ8eru$
    >
    > regular intervals, and no later than 30 days before the meeting
    > begins, the list of registered participants and financial institutions
    > The IETF Executive Director will work with IETF LLC counsel to
    > determine what action to take in each individual case. This may
    > include not pursuing the contractual relationship, revoking the
    > meeting registration, cancelling any existing contract or other action.
    > ---- cut here ----
    >
    >
    > North Korea, Sudan or Syria being rejected their registration, and
    > hence being prevented to participate in IETF meetings?
    >
    > inappropriate, discriminatory, oppressive, and ultimately
    > unacceptable. I hope that that's not even a possibility.
    >
    > P.S.: Besides sanctions on countries such as the above, there also
    > seems to be a whole list of people and organizations that are
    > sanctioned/banned:
    > https://urldefense.com/v3/__https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists__;!!CQl3mcHX2A!Q1GNI366X53XWJ2mE3LM8RWY7VpMRPj7tJu-UFP_pCAMfN_4FX-U1L0iigqlgWNb2KKJJkOB$
    >
    > Thanks,

---

From: Fernando Gont <[email-masked]>
Date: Wed, 3 Mar 2021 19:25:14 -0300

Hi, Jason,

Thanks a lot for your response! In-line....

On 3/3/21 19:16, Livingood, Jason wrote:
> Hi Fernando - I am not aware of any data to suggest that it has even
> been an issue. But please also bear in mind that the OFAC compliance
> need flows down from the Internet Society, since the IETF LLC is
> within the Internet Society corporate umbrella. We're of course
> always happy to consult with counsel if needed, but it would help to
> know if you have any data here.

I don't have data.

But if a possible outcome is that people could be prevented from
participating in meetings, that would be a discriminatory policy, and as
such, unacceptable -- regardless of how many people (if any) may have
been affected so far.

So yes, I still think an authoritative answer is needed here.

Thanks,

-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 3 Mar 2021 22:26:30 +0000

> The problem is that there isn't an alternative to living with OFAC, because the Internet Society is incorporated in the United States and the IETF LLC is (a disregarded entity that is in some sense) a ypart of the Internet Society.  There are structural reasons why incorporating the Internet Society outside that United States is not a practical possibility either, but the reasons for this are probably best discussed on a list about the Internet Society rather than the IETF.

Agree, it flows from our corporate association as part of the Internet Society. It is important to bear in mind that other entities would also face similar compliance needs, such as banks and credit card payment networks (example: https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-rules.pdf).

Jason

---

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 3 Mar 2021 22:36:49 +0000

While IANAL, IMO a discriminatory policy assumes we have decision-making power in this area whereas what we have is a compliance burden we are required to meet as a matter of law (slightly different framing).

I know the Secretariat and Executive Director are working on responses and appreciate your patience in waiting for that. If you still have questions after that, we are happy to involve counsel and we potentially could have some Q&A on the matter at during the open portion of next week's board meeting if you could attend.

Jason

---

From: Jay Daley <[email-masked]>
Date: Thu, 4 Mar 2021 12:42:27 +1300

Fernando

(moved to admin-discuss)

I was in the process of replying to your last direct email to me about this but let me reply publicly now:

> On 4/03/2021, at 10:32 AM, Fernando Gont <[email-masked]> wrote:
> 
> Folks,
> 
> While studying the topic of diversity and inclusiveness in the IETF, the question arouse about what are the implications of the IETF LLC being registered in the USA.
> 
> In particular, I'm concerned about the possible implications for participants from USA-sanctioned countries or organizations.
> 
> I asked a few people here and there, and was referred to this document: https://www.ietf.org/media/documents/IETF_LLC_OFAC_Compliance_Policy_2020-10-06.pdf
> 
> The current automated meeting registration system can continue, but at regular intervals, and no later than 30 days before the meeting begins, the list of registered participants and financial institutions associated with payment of registration fees must be checked (both for individual names and country of domicile and residence).
> ---- cut here ----
> 
> and
> 
> ---- cut here ----
> Action
> The IETF Executive Director will work with IETF LLC counsel to determine what action to take in each individual case. This may include not pursuing the contractual relationship, revoking the meeting registration, cancelling any existing contract or other action.
> ---- cut here ----
> 
> 
> I'm certainly not a lawyer, and hence I'd like an authoritative and clear explanation about what are the possible outcomes of this "OFAC Compliance Policy".
> 
> For example, could it result in participants from Cuba, Iran, Myanmar, North Korea, Sudan or Syria being rejected their registration, and hence being prevented to participate in IETF meetings?
> 
> If that were the case, I'm sure that we'd all agree that that would be inappropriate, discriminatory, oppressive, and ultimately unacceptable. I hope that that's not even a possibility.
> 

There are multiple reasons why someone might be prevented from participating in person in an IETF meeting by government policy.   One is a governmental sanctions policy and another is local border control, generally through the visa process.

The US government indeed has a sanctions policy, referred to as OFAC, but you may not be aware that many other governments also have one.  For example, the EU has such a policy: https://eeas.europa.eu/topics/sanctions-policy_en?page=1

You may also not be aware of just how widespread the impact of sanctions policies are and the nature of direct and indirect impact.  Looking at the direct impact, every US company and individual including the LLC is covered.  For example, every online service such as Twitter, GitHub, every US based airline, every US drug company and so on.   The much broader impact is indirect - a company outside of the US that does business with sanctioned people/companies/countries can in turn be subject to sanctions.  

For border control, every country in the world operates a visa scheme that restricts who can enter based on their country of residence, occupation etc.   When we consider a specific country for a meeting that is one of the things we look at, and while we aim for the restrictions to be as light as possible, there will always be some people who might be affected. 

So, to answer your question, yes we may end up in a situation where we deny access to an in-person meeting to someone from an OFAC sanctioned country - it depends on the specific person and the circumstances around that.  We may even need to deny them remote participation.  There are options available to us, such as applying for a license or pursuing a more general exemption as a standards setting organisation, but none of those can be guaranteed. 

No matter how much we might wish it to be different, we are constrained by two inescapable facts:

1.  It is simply not possible to locate a company anywhere in the world where it does not need to consider the impact of sanctions.  
2.  It is simply not possible to find any location on the planet where everyone is free to travel to.

Jay

> 
> P.S.: Besides sanctions on countries such as the above, there also seems to be a whole list of people and organizations that are sanctioned/banned: https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists
> 
> Thanks,
> -- 
> Fernando Gont

-- 
Jay Daley
IETF Executive Director
[email-masked]

---

From: Fernando Gont <[email-masked]>
Date: Wed, 3 Mar 2021 21:15:03 -0300

Hello, Jay,

Thanks for your response! In-line....

On 3/3/21 20:42, Jay Daley wrote:
[...]
> 
> You may also not be aware of just how widespread the impact of
> sanctions policies are and the nature of direct and indirect impact.

Not sure why you'd think so....

>  Looking at the direct impact, every US company and individual
> including the LLC is covered.  For example, every online service such
> as Twitter, GitHub, every US based airline, every US drug company and
> so on.   The much broader impact is indirect - a company outside of
> the US that does business with sanctioned people/companies/countries
> can in turn be subject to sanctions.

FWIW, I find this *very* oppressive.

> So, to answer your question, yes we may end up in a situation where
> we deny access to an in-person meeting to someone from an OFAC
> sanctioned country - it depends on the specific person and the
> circumstances around that.  We may even need to deny them remote
> participation.  There are options available to us, such as applying
> for a license or pursuing a more general exemption as a standards
> setting organisation, but none of those can be guaranteed.

Is the issue associated with the economic transaction involved to pay 
the meeting fee?  Or actually with participation (regardless of whether 
a fee is being paid or not)?

Put another way: would a fee waiver guarantee f2f/online meeting
participation of individuals from USA-sanctioned countries, as far as
the IETF LLC is concerned?   (of course, visas and others are not up to 
the IETF).

And if such participation is not guaranteed, why would mailing-list
participation be any different in this respect?  Or should one also 
expect that participants from USA-sanctioned countries could also be 
banned from employing the IETF mailing-lists?

> 1.  It is simply not possible to locate a company anywhere in the
> world where it does not need to consider the impact of sanctions. 2.
> It is simply not possible to find any location on the planet where 
> everyone is free to travel to.

I haven't done such an assessment myself to be able to tell if things 
could be any different..

That said, in this particular case the sanctions would seem to affect 
even on-line participation (aside from travel/visa issues).

Thanks,

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 4 Mar 2021 01:31:07 +0000

On 3/3/21, 7:16 PM, "admin-discuss on behalf of Fernando Gont" <[email-masked] on behalf of [email-masked]> wrote:

    >> so on.

    > FWIW, I find this *very* oppressive.

[JL] Are you available to join the next LLC board call on 11 March at 20:00 UTC?

[JL] None of us are lawyers or specialists in OFAC compliance -- we're getting into legal territory that would best be answered by counsel at the next LLC meeting, if you could join us at that time. I have added it to our agenda. Details and Webex link at https://www.ietf.org/about/groups/llc-board/meeting-info/.

Jason

---

From: Fernando Gont <[email-masked]>
Date: Wed, 3 Mar 2021 23:30:15 -0300

> [JL] Are you available to join the next LLC board call on 11 March at 20:00 UTC?

I'm almost sure I can join.

> [JL] None of us are lawyers or specialists in OFAC compliance -- we're getting into legal territory that would best be answered by counsel at the next LLC meeting, if you could join us at that time…

Is the meeting open? -- I ask because I guess somebody else with more 
knowledge than myself might also be able to join, and ask better 
questions, or contribute better than myself. As noted, I'm sure I'll be 
able to join.

e.g., RIRs thend to deal with many of these countries: RIPE wiht IRan, 
LACNIC with Cuba....

Thanks,

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 4 Mar 2021 02:46:25 +0000

The first part of the meeting is always open and this agenda topic certainly will be.

________________________________
From: Fernando Gont <[email-masked]>
Sent: Wednesday, March 3, 2021 9:30:15 PM
To: Livingood, Jason <[email-masked]>; [email-masked] <[email-masked]>
Subject: [EXTERNAL] Re: [admin-discuss] IETF LLC & IETF Participation from USA-sanctioned countries

> [JL] None of us are lawyers or specialists in OFAC compliance -- we're getting into legal territory that would best be answered by counsel at the next LLC meeting, if you could join us at that time. I have added it to our agenda. Details and Webex link at https://urldefense.com/v3/__https://www.ietf.org/about/groups/llc-board/meeting-info/__;!!CQl3mcHX2A!VWP7b-zom5rCzglCADLllPrW4Qgyg351-sfusH9cG6jOg__WEqeS0q1hOHmsmS4OFhNBMA$ .

Thanks,

---

From: "Livingood, Jason" <[email-masked]>
Date: Sat, 6 Mar 2021 16:24:16 +0000

On 3/5/21, 7:06 PM, "ietf on behalf of Fernando Gont" <[email-masked] on behalf of [email-masked]> wrote:

>    * Are participants from sanctioned countries or organizations allowed to
    participate in mailing-list discussions, and e.g. publish
    Internet-Drafts, or RFCs?

>    * Could they join fwf meetings? Could they join online meetings?  If
    not, is the limitation associated with payment of the fee, or with
    something else?  Would a fee waiver "solve" this?

[JL] Please join the next board meeting - next week. We will have counsel on the call to discuss this.
https://www.ietf.org/media/documents/Copy_of_2021-03-11-llc-board-agenda.pdf

---

From: "Livingood, Jason" <[email-masked]>
Date: Tue, 9 Mar 2021 13:52:45 +0000

On 3/8/21, 9:46 PM, "ietf on behalf of Fernando Gont" <[email-masked] on behalf of [email-masked]> wrote:
>    For the most part, the motivation of this thread has been to find an
    authoritative answer regarding how OFAC compliance could possibly affect
    participation.

[JL] As noted we will discuss this at the LLC board meeting this week. But it seems important to note that we have no indication that anyone has ever been affected by this. So FWIW if you are searching for things negatively affecting participation - this does not seem to be one of them.

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 12 Mar 2021 15:56:53 +0000

Hi Toerless - We covered this briefly in yesterday's IETF LLC meeting with counsel. We took an action item to get back to the community with a bit of formal text on this. But the summary is that we have no evidence to suggest OFAC rules have on their own prevented participation or would in the future. Stay tuned for more info & have a nice weekend.

- Jason

On 3/12/21, 6:26 AM, "ietf on behalf of Toerless Eckert" <[email-masked] on behalf of [email-masked]> wrote:

    Thanks, Andrew

    So, when i understand this correctly the normal procedure would be to
    ignore or report to the authorities requests for sanctioned transactions.

    Would it not also be possible to forward such requests to the IETF lawyer
    and have them publish the request, therefore letting folks (lawyers)
    who do know how to handle these things legally correctly do the job ?

    Cheers
        Toerless

    On Thu, Mar 11, 2021 at 02:19:24PM -0500, Andrew Sullivan wrote:
    > Hi,
    >
    > Usual disclaimer: I work for ISOC, but this isn't their opinion.  For the avoidance of doubt, nothing I am talking about is somethng I learned during my current employment.
    >
    > On Thu, Mar 11, 2021 at 06:56:35AM +0100, Toerless Eckert wrote:
    > >
    > > What is the easily found public URL where any such case is documented ?
    >
    > I would be astonished if there were one.  Documenting such a case would be publicly acting on a request from a sanctioned entity, which would be tantamount to admission that one processed their request, which (under the relevant interpretation) would incur a legal risk of having violated the sanctions.  If you feel that you are reading a passage from _Catch 22_, I appreciate your sensation.
    >
    > Best regards,
    >
    > A
    >
    > --
    > Andrew Sullivan
    > [email-masked]

    --
    ---
    [email-masked]

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 12 Mar 2021 17:04:42 +0100

Thanks a lot, Jason

I was actually interested to see an easy landing point (URL) not only
for OFAC, but also stuff like visa regulations, EAR and whatever
else is a real (or imagined) challenge to our community. If something
like OFAC is "imagined" or "not yet" a challenge, thats nice to hear.
But for example, the impact and reaction of EAR was also mostly communicated
mouth to mouth only.

Cheers
    Toerless

On Fri, Mar 12, 2021 at 03:56:53PM +0000, Livingood, Jason wrote:
> ???On 3/12/21, 6:26 AM, "ietf on behalf of Toerless Eckert" <[email-masked] on behalf of [email-masked]> wrote:
> 
>     Thanks, Andrew
> 

-- 
---
[email-masked]

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 12 Mar 2021 16:48:02 +0000

mouth to mouth only.

Actually last year the LLC put a response to this in writing at https://mailarchive.ietf.org/arch/msg/ietf-announce/0ywjgSS4LlO0DaWDoLJLRHxJdUk/ and we link to this under our Announcements page at https://www.ietf.org/about/administration/announcements/.

Does that address the need you perceive or do we have a gap to fill on this issue?

Thanks
Jason

On 3/12/21, 11:05 AM, "admin-discuss on behalf of Toerless Eckert" <[email-masked] on behalf of [email-masked]> wrote:

    Thanks a lot, Jason

    Cheers
        Toerless

    --
    ---
    [email-masked]

    --
    admin-discuss mailing list
    [email-masked]
    https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/admin-discuss__;!!CQl3mcHX2A!SmCmR0Ug0TgMVUeRgVsJr5JyUCeZ7OWuaZNt6kX_vWz3bT_3cm5se-A1LsoBO7Fodop4Tw$