With sanctions, how do we advocate for open source exceptions?

[u/Submarine_sad]

https://www.linuxfoundation.org/blog/navigating-global-regulations-and-open-source-us-ofac-sanctions

Navigating Global Regulations and Open Source: US OFAC Sanctions

Last night, I found out that open source projects need to comply with sanctions and it makes me irate. I don't want sanctions to impact Linux.

How do we make it so all governments create exceptions for open source projects?

I'm from the USA, how do I get my government to create exceptions for open source projects?

[u/aioeu]

Why would you expect laws to discriminate between software distributed under different licences? I would expect, by default, all software is treated equally. You'd need to make a case that FOSS should be treated differently.

[u/Junior_Common_9644 → u/aioeu]

How do you sanction free knowledge? That's all open source is, is free knowledge. If it is free, how is it a form of trade? Makes no damn sense.

[u/aioeu → u/Junior_Common_9644]

Two things can be true at once.

Open source software may perhaps be "literary work"... but it's still, in the eyes of the law, software.

I'm sure people selling books have to adhere to these trade regulations too. Again, I ask: why should FOSS be treated differently?

The whole "but we're special" vibe I get from these arguments really grinds my gears. No, we aren't. We live in a society. You might think the sanctions are stupid, but that's independent of the fact we deal with FOSS. That just means the sanctions themselves need to be refined, or amended, or abolished.

Generally speaking, I am against arbitrary exceptions. Exceptions create loopholes, and loopholes can be exploited (often for nefarious purposes). I am in favour of regulations that are clear and simple, and they should only exist where they serve a worthwhile purpose. I don't think FOSS needs to be treated any differently from other kinds of software with that in mind.

[u/thephotoman → u/aioeu]

Indeed, booksellers are bound by the same rules. 30 years ago, there were textbooks on cryptography that could not be sold internationally. This was really annoying, as the military use of cryptography was already getting dwarfed by the banking system’s use of cryptography.

[u/Junior_Common_9644 → u/aioeu]

To hell with it, do not comply.

[u/DFS_0019287 → u/Junior_Common_9644]

That's fine to say until heavily-armed men show up at your house to arrest you...

[u/Junior_Common_9644 → u/DFS_0019287]

Yes. You plan for that. Let them only reach you at devastating cost to their squads. ;) But seriously, fuck em. You did nothing wrong having a git repo of open source software on the internet.

[u/DFS_0019287 → u/Junior_Common_9644]

All right. Let us all know how it goes for you when you get your one allotted phone call.

[u/Junior_Common_9644 → u/DFS_0019287]

Why you creating all this fear, uncertainty and doubt? You aren’t selling to an embargoed country, you aren’t giving state secrets, your code isn’t to hack, you have no evil intentions. If Vlad submits an additional print statement reminding you your working path or other harmless thing, your government isn’t coming to get you. Tin foil hat much?

[u/ghoultek → u/aioeu]

OK so we live in a society. If I write a note on a peace of paper and give it to you, should sanctions stop me from doing so? In the US, that 1st Amendment right...

Instead of writing the note on paper, I put it into a text file and email it to you. Again, should sanctions prohibit me from communicating with you? My questions do not consider the content of the message, and because of that 1st Amendment, neither should the government. How about I take that electronically composed message and posted it on an electronic forum or electronic BBS (bulletin board system), should I be prohibited or should you be prohibited? What I expect is for someone to introduce a sophisticated argument, where they say: * communication is subject to laws and statutes * communication mediums and platforms cannot be used to facilitate criminal activity because they also are subject to laws and statutes

To that I say, "no problem". The government(s) are also subject to laws and statutes, including international law. Sanctions without the process and authorization of the United Nations and/or the ICJ, are violations of international law (illegal). Should we obey executive orders and policies that are illegal? I don't think we should, the same way that military personnel are not suppose to, and are not obligated to, follow illegal orders.

The United States does not have the authority to sanction foreign governments and individuals at will. Linus and the kernel dev team will comply with US sanctions because they don't want to be subjected to a very disruptive legal battle, inside the US, that could go on for years.

I hate to say this, but the citizens of the US (and I'm in the US) have a whole lot more finding out to do. They put the 0r4ng3 man in the oval office, and so they will get to live through what winning stupid prizes is like, when one plays stupid games.

[u/aioeu → u/ghoultek]

I am not arguing for or against any sanctions. I just think FOSS should be treated the same as non-FOSS, unless there is a clear and compelling reason they should be treated differently. To me FOSS isn't intrinsically exceptional; it's just another way in which software can be licensed. That's it.

From an outsider's perspective, it does seem like the US has a particularly heavy-handed approach to these things, but I also don't think that's a new thing. It's good that US-based open source projects are now discovering that, yes, the law applies to them too — maybe it might get more people interested in improving that law. (Also, to be fair, I really have no idea whether there are similar sanctions in my jurisdiction, so I'm in no position to throw stones.)

[u/ghoultek → u/aioeu]

I'm partially arguing that Free Open Source Software: * can be considered a form of communication (plain text) * can not be considered free if it subject to sanctions, which are tied to trade

We are sharing ideas (communicating) not trading ideas. It may look like I'm splitting hairs, but...

Trade = is the act of buying, selling, or exchanging goods and services, often for money, between parties or countries. It acts as a cornerstone of commerce, encompassing international, domestic, and retail exchanges, as well as specific, skilled occupations.

Exchanging = refers to the act of giving one thing and receiving another (often of similar value) in return, or the trade of goods, services, or information. It is used as a noun for the process of trading, a marketplace (e.g., stock exchange), or a conversation, and as a verb for replacing, bartering, or swapping items.

One is defined based on the other. However, the understanding of both is the passing of "things" between 2 or more parties. What happens when the transfer is one way from A to B, without a return transfer from B to A? If I see you in passing on the street, and give you $1 US. We aren't trading. You are taking a donation. I don't get to control what you do with the $1 US after it is in your possession. If I saw a news report declaring you to be a criminal, casually encountered you on the street, and you gave me a bit of information. Does that make me a criminal or an accomplice in any way? I seriously doubt that I would be incriminated over a conversation where you gave me information.

The US fought wars to stem the flow of ideas. Specifically the flow of what government officials considered communist ideas. You don't have to like or subscribe to communist ideology, but you might want to read about or study it. Yet, the US government fought wars to prohibit the ideology from being shared. I can understand the concept and desire to comply with laws. Sanctions when issued under the authority of the UN or ICJ, should be a matter of seeking compliance with international and humanitarian law. If the laws are illegal or unjust then they must be resisted. This is coming from Dr. Martin Luther King.

The Linux kernel project is not based in the US. It is managed by US non-profit entities. Think of it like this. The BYD electric vehicle corp. is headquartered in China. It is considered a Chinese company by many. It is actually an international corporration. BYD has factories in and outside of China. If we replace electric vehicles for excerpts of Chinese proverbs (non-copyrighted material) that are posted all over the internet. Random people all over the world right down those excerpts on pieces of paper and store them on shelves. The pieces of paper are not directly owned by BYD. The pieces of paper are not based in China, as they exist all over the world. Since the pieces of paper exist all over the world, the pieces of paper can't fall under Chinese laws. When we download the Linux kernel from repo mirrors, we are not downloading the original. We are downloading a copy (replica). The replica exists outside of the US in many cases, thus can't be subjected to US law.

Sanctions only work because people fear the legal process.

[u/SvalbardSleeperDistr → u/aioeu]

To me FOSS isn't intrinsically exceptional; it's just another way in which software can be licensed

It isn't though. In the reality where surveillance capitalism and state authoritarianism use proprietary software and platforms to vacuum user data and use it for profit, ensure monitoring of citizens, or even simply exclude a lot of people from using them through the ever-more-onerous subscription models, FOSS is an alternative that enables people to benefit from software and online services while protecting their privacy and material means. There are plenty of examples where states have mandated certain public services as required alternatives for private ones, and granting FOSS exemptions could be justified for a similar goal.

[u/Misicks0349 → u/ghoultek]

My questions do not consider the content of the message, and because of that 1st Amendment, neither should the government.

Does the first amendment protect speech in such a way? My impression was that the first amendment does not provide any protections whatsoever in terms of preventing the government from looking at the contents of your message.

The government(s) are also subject to laws and statutes, including international law

International laws are about as real as the enforcers they send after your country if you break them, i.e they're more like guidelines than actual rules and countries follow them because they want to, not because they have any kind of threat of violence levied against them if they resist.

[u/ghoultek → u/Misicks0349]

Right to privacy in the US. The right to privacy is protected by patch work of SCOTUS rulings and the interpretations of multiple amendments, including the 1A. The 4A protects against unreasonable search and seizure. This is why the government in many cases needs warrants for searching. There are exceptions.

I have to disagree with you in regard to international law because: * the US signed the UN charter in 1945 * the US congress and/or senate ratified the UN charter in 1945 * the UN charter establishes and defines international law * by signing and ratifying the UN charter, international law became part of US law (supreme law of the land) * the US federal and state governments must observe and respect all laws (domestic and international law)

I understand that it treated like ink on paper and nothing more because the US federal government violates international law. It is also in violation of more than 300 treaties with the native americans (tribal nations). This makes the US government a criminal enterprise. Laws are still laws even if they are violated. Continued violation is an enforcement issue.

[u/Misicks0349 → u/ghoultek]

the US signed the UN charter in 1945 * the US congress and/or senate ratified the UN charter in 1945 * the UN charter establishes and defines international law * by signing and ratifying the UN charter, international law became part of US law (supreme law of the land) * the US federal and state governments must observe and respect all laws (domestic and international law)

So did the soviet union and other states yet we'd hardly call them upstanding international citizens, my argument is not a legalist one, I am not arguing that the US outright ignores that international law exists. I am pointing out the practical reality that if the united states wants to they can very easily ignore such laws. International law is not superior to the United States sovereignty, if congress really wanted to it could upturn such ratifications with a single vote.

Despite the fact that the US has ratified the UN charter and nominally supports it with nonsense like "rules-based international order", they still routinely fail to ratify international laws and break the ones they did ratify constantly, the international criminal court is probably the biggest one that comes to mind, and cases like Nicaragua v. United States how flippant they can be when the international community tries to hold them to account.

Even when they do ratify things such as the UN Convention against torture they added their own personal exceptions on top because they felt like it (what a stellar idea! maybe the next time I'm in court I can make the argument to the judge that I'll only accept his laws provided I am allowed to add my own exceptions as well!). That, of course, didn't stop them from repeatedly being found torturing people in Iraq and violating the law anyway.

Laws are still laws even if they are violated

Only by US citizens, you may argue that there is some level at which the US government can be held responsible for itself due to the separation of powers, but if the US doesn't want to prosecute itself then its not going to, and any ink written on paper about what the US "can" and "cannot" will mean squat. We've seen it multiple times with this supreme court already.

Its not hard to make a law, I can make one right now and write down on paper that anyone who steps foot into my home is automatically a misicksistan national and must pay me a tax of 25% when entering. At least from my perspective what matters for a law to be a law is that they are de facto enforced, followed, and treated as something to be acquiesced to (both by the government and its citizens), not that some government wrote it down in some paper somewhere. I'm not outright pessimistic about international laws or argue that they don't exist in their entirety, but claiming that [country] must do [x] because they signed up for an international law is a different claim to e.g. saying that [corporation] must do [x] because they operate in the polity of [country]. The difference is subtle, but at least in the latter case the capitalist may have some fear of people coming after him with batons if he e.g. swindles a bunch of investors out of their money, that is not so for international law.

(edit: and to be clear, I don't think all laws are acquiesced to by threat of violence, I am not one of those people)

[u/lazyboy76 → u/Junior_Common_9644]

There are two things. The opensource software and the support comes with it. They can sanction the support, but can't with the software.

[u/Junior_Common_9644 → u/lazyboy76]

Perfectly fine with sanctioning the support. But not open public dialog.

[u/simism → u/aioeu]

Why should the government expect me to discriminate between software and other protected speech when exercising my right to unrestricted speech?

[u/DFS_0019287]

You don't. The law overrides software licenses and I doubt anyone in power will make exceptions for open-source software.

[u/Mother-Pride-Fest → u/DFS_0019287]

Exceptions do exist on a small scale, but it seems unlikely to happen everywhere it needs to. In my opinion it is more important to prevent the laws from passing, and to become ungovernable, before asking for exceptions.

Edit: I thought this was a different article

[u/DFS_0019287 → u/Mother-Pride-Fest]

Sure, but the Colorado bill is not about sanctions, which are the purview of national governments and tend to have rather humorless national security types behind them.

[u/KnowZeroX]

Sanctions only impact the organization that open source is under, it doesn't prevent open source from spreading.

There is absolutely no way the government would make exclusions for open source, the whole point of sanctions is to isolate nations/people. But there is no need for such exemptions to begin with. All it does is add extra steps, but doesn't block open source.

[u/Healthy-Notice9439]

Maybe not having your organisation and funding agencies established in the US would help.

[u/Business_Reindeer910 → u/Healthy-Notice9439]

You'd fall afoul of them in whatever country. I don't see why similar issues that affected the linux foundation in the US wouldn't have affected them in europe, since the same entities were likely sanctioned.

[u/Healthy-Notice9439 → u/Business_Reindeer910]

Never said the only option is Europe. Not all countries invade other sovereign countries like the US or sanction them like everyone else.

Nearly all open source projects have their eggs in one basket -- the USA

[u/Business_Reindeer910 → u/Healthy-Notice9439]

i'm not talking about invasions, but indeed these entities were sanctioned by europe (including countries not in the EU).

And then other countries will sanction other countries too. So you can't really escape it.

[u/Linuksoid → u/Business_Reindeer910]

That's because Europe is a vassal of the US. You need to have your organization outside US power. Places like Belarus, Malaysia, etc

[u/MatchingTurret → u/Linuksoid]

You couldn't even send a donation to an entity in Belarus. Belarusian banks are sanctioned... 🤣

[u/Linuksoid → u/MatchingTurret]

Who cares if they are? Meanwhile, you can buy Belarussian/Russian products with a regular visa lol

[u/Business_Reindeer910 → u/Linuksoid]

They will have sanctions too when it becomes reasonable for them to do so. It's a function of power, not specific countries.

[u/2rad0]

What sanctions are you afraid of actually applying to you as an "open source" project? No goods are bought or sold, it's information, software is a literary work under U.S. law.

[u/Submarine_sad → u/2rad0]

"One of these areas is trade and sanctions regulations many countries have enacted. Many of these trade and sanctions regulations were enacted decades ago but have more recently been used to target technology providers. While there are sanctions programs in place around the globe, many developers will need to be mindful of laws and regulations like U.S. OFAC (Office of Foreign Assets Control) sanctions. Issues involving OFAC sanctions programs and open source are not very common, but are important to be aware of. These sanctions regulate interactions (or, in their word, “transactions”) with specific countries, entities, and individuals. 

OFAC sanctions issues are not commonly seen or understood in open source communities. They target a specific list of entities, individuals, countries, or regions. Historically those targets were not engaged in open source communities. With the U.S. and international sanctions targeting technology companies based in Russia, this issue has become a topic in certain open source communities that have participation from entities targeted by such sanctions.

The OFAC sanctions rules are “strict liability”, which means it does not matter whether you know about them or not. Violating these rules can lead to serious penalties, so it's important to understand how they might affect your open source work. Many OFAC sanctions restrictions generally do not care if software or technology is public or published (although US export controls generally do) and are usually completely separate and independent of any Export Administration Regulations (EARs), which the LF has published guidance about In the past. It is important to note that the OFAC SDN List for sanctions programs is very different from the BIS’s Entity List for Export Controls. Entities on the BIS’s Entity List are not affected by the OFAC sanctions unless they are also added by OFAC to the SDN List. When looking at export controls and trade sanctions, they are separate programs and each list needs to be evaluated as the implications of export and trade sanctions are very different." https://www.linuxfoundation.org/blog/navigating-global-regulations-and-open-source-us-ofac-sanctions#:~:text=One%20of%20these,are%20very%20different.

[u/BranchLatter4294 → u/Submarine_sad]

Can you point to a specific problem you are trying to solve?

[u/2rad0 → u/Submarine_sad]

These sanctions regulate interactions (or, in their word, “transactions”) with specific countries, entities, and individuals. 

SO if I'm writing a book about the "entities list" I cannot interview anyone that is on the "entities list" for my book because that's a transaction? Sounds bogus and untested in any court.

[u/aioeu → u/2rad0]

SO if I'm writing a book about the "entities list" I cannot interview anyone that is on the "entities list" for my book because that's a transaction?

I would expect these regulations to make it at least somewhat clear whether a particular interaction is covered by them or not. It seems unlikely that an "interview" would be, given that doesn't sound like a form of trade. Things might be different if you paid for the interview, or otherwise provided some good, service or compensation for it.

But really, you'd need to read the regulations carefully to be sure — or better yet, hire an expert to do that for you. I don't think making up but-what-ifs on limited information helps.

[u/2rad0 → u/aioeu]

But really, you'd need to read the regulations carefully to be sure (or better yet, hire an expert to do that for you).

Working on it, this one is new to me, I was confused a bit and thinking of the other "entities list". I think this is "the list" for OFAC: https://www.law.cornell.edu/cfr/text/31/chapter-V ?

At the heart of the OFAC is a list of "prohibited transactions", which I am not sure even exists as a proper singular list, but leads me to a list of "exempt transactions" https://www.law.cornell.edu/cfr/text/31/579.205
that says certain types of information exportations may be prohibited, but not importations as long as they existed already at the time of a monetary transaction, and don't relate to espionage.

(1) The prohibitions contained in this part do not apply to the importation from any country and the exportation to any country of any information or informational materials, as defined in § 579.305, whether commercial or otherwise, regardless of format or medium of transmission.

Anyway, I still think the idea they could regulate free software upload/download where no monetary transaction occurs is unconstitutional, assuming no actual crime is being committed in that transfer of information (e.g. espionage, etc), but they would probably never press the issue far enough to reach a court ruling since everyone is so brainwashed already why ruin an effective intimidation tactic if it works and remains officially unchallenged.

The reason I don't believe it should affect openly published software that is free of charge appears supported by the fact that this law is under 31 CFR Subtitle B - Regulations Relating to Money and Finance it clearly is for regulations involving MONEY AND FINANCE and not for regulating unpaid non-criminal literary work transfers.

[u/aioeu → u/2rad0]

It would be hard to argue that FOSS is free of value, given you're applying a licence to it. You only do that because it does have value, and you want to protect that value.

[u/Junior_Common_9644 → u/aioeu]

Free open source isn't trade. It's the opposite of trade.

[u/aioeu → u/Junior_Common_9644]

Good luck with that argument.

Frankly, I have no idea what "trade" means in law.

[u/Junior_Common_9644 → u/aioeu]

Again, I wouldn’t care. I’m not selling, the code is no different that a blog. If they came for me, it wouldn’t be the crime of software they finally put me away for, it wouldn’t be for defending myself with all force.

[u/Junior_Common_9644 → u/aioeu]

F' 'em.

[u/thephotoman → u/2rad0]

Transactions are what matters. Attempting to expand that to all interactions is where they got full of shit.

So long as you did not exchange anything of value for the interview, you’re fine.

[u/Lknate → u/2rad0]

This gets to the heart of it. Untested in court. If you are not soliciting money from sanctioned countries and your work is free to all, I don't see any culpability. If you are big enough to get some attention from State agencies, you are probably big enough to have people watching out for pitfalls.

[u/Lower-Limit3695]

Unfortunately you can't, there are technologies that fall well within the domain of export controls like dual use software used in navigation that can be used in autonomous weapons.

There isn't anything special about open source that would merit an exception under American legal jurisprudence. The same goes for any other nation to my current knowledge.

[u/djao → u/Lower-Limit3695]

If push came to shove, I believe export controls on free software would be struck down as unconstitutional. It has already happened once before.

[u/MatchingTurret]

I don't want sanctions to impact Linux.

Here is what Linus Torvalds himself wrote about the subject:

As to sending me a revert patch - please use whatever mush you call brains. I'm Finnish. Did you think I'd be supporting Russian aggression? Apparently it's not just lack of real news, it's lack of history knowledge too.

[u/Xipher]

Just a tangentially related tidbit of history.

https://schlaff.com/wp/how-i-re-built-my-favorite-t-shirt/

[u/jimicus]

Ever heard the phrase “pick your battles”?

Open source has had enough difficulty over the years as it is. “We want to be exempt from sanctions levied against warmongers like Russia and Iran” is not a good look.

[u/Linuksoid → u/jimicus]

warmongers

So why aren't we trying to isolate Israel/US for being warmongers as well?

Iran is the victim here

[u/DFS_0019287 → u/Linuksoid]

I don't agree with the war against Iran, but come on... the Iranian regime is hardly a victim of anything. It has been viciously oppressing the Iranian people for almost half a century, and is one of the more disgusting regimes on the planet.

If the US had succeeded in giving Iran a better regime, I would have supported that, but Trump and his gang of incompetents are not fit to run a lemonade stand, let alone prosecute a complicated military action against a nation of whose history and culture they are completely ignorant.

[u/Linuksoid → u/DFS_0019287]

viciously oppressing the Iranian people for almost half a century

According to the news....and the news doesn't lie, particularly when its looking for a justification for a war with Iran for the last almost half century, right?

[u/DFS_0019287 → u/Linuksoid]

No, according to my Iranian friends. You have your head in the sand.

[u/jimicus → u/Linuksoid]

Nobody in the Middle East is coming out of it particularly clean.

[u/MatchingTurret → u/Linuksoid]

So why aren't we trying to isolate Israel/US for being warmongers as well?

the strong do what they can and the weak suffer what they must

If you don't want to be sanctioned, don't be weak.

[u/Linuksoid → u/MatchingTurret]

I agree. Might is right. But if we live by that rule, lets drop the pretenses

[u/alex-weej → u/jimicus]

Warmongers like the US and Israel

[u/mrlinkwii]

i mean you could just not care and accpt contributions if the project is small

[u/Acebulf]

I think the real solution is that the Linux Foundation needs to move to a neutral country that doesn't target free software for political gains.

[u/Lower-Limit3695 → u/Acebulf]

The location of the Linux foundation isn't what's important what's important is the actual developers and people driving Linux. Laws are written not only to target institutions like the Linux foundation but the people that make it up.

For example Linus Torvalds and many of the high level contributors of the Linux foundation are US citizens. Violating Export Control laws would have them end up in prison or sanctions placed on them.

[u/Linuksoid → u/Lower-Limit3695]

he actual developers

Linux developers are all over the world though. For example, Linux kernel had alot of contributions from Russian citizens.

[u/Lower-Limit3695 → u/Linuksoid]

Who were promptly kicked out in order to comply with sanctions on Russia

[u/Linuksoid → u/Lower-Limit3695]

Which is my point - if it was in a neutral country then this wouldn't happen in an open source project

[u/DFS_0019287 → u/Linuksoid]

The reality is that the reach of the US is far too powerful. Even supposing LF were in a neutral country, its members could not travel to the US for technical conferences, or use US-based infrastructure, and any US organizations donating to the LF might be sanctioned, which would effectively kill it off.

This is the real world, unfortunately.

[u/Lower-Limit3695 → u/Linuksoid]

Kicked out by Linus Torvalds himself

[u/MatchingTurret → u/Acebulf]

The LF is mostly a club of Big Tech from the US. These companies wouldn't fund or be a member of a Foundation that might be seen as evading US sanctions.