> ... sanctions and export control laws tend to be fairly strict, and penalties for knowing non-compliance are harsh, including the possibility of jail time. Y

> ... sanctions and export control laws tend to be fairly strict, and penalties for knowing non-compliance are harsh, including the possibility of jail time. Yeah, no kidding. It's not even "knowing non-compliance", though -- although that's almost certainly worse. To illustrate this with an example that most HN readers will easily understand (and which some might even be affected by): The Office of Foreign Assets Control (OFAC) of the Department of the Treasury recently issued an advisory [0,1] to "alert" U.S. companies of the potential risks of "facilitating" ransomware payments. The TL;DR is that "U.S. persons, wherever located" are subject to heavy civil penalties -- under "strict liability" -- if you "facilitate" a payment from a ransomware victim that ultimately ends up going to an "entity" that's in one of the embargoed/sanctioned countries (Iran, North Korea, Syria, Crimea, Cuba, ...) or on OFAC's "Specially Designated Nationals and Blocked Persons List". "Strict Liability", by the way, means that you're still liable and subject to penalties even if you "did not know or have reason to know". "Oh, really? Oh, well, that's too bad. You're still liable, pay up!" Finally, think about how broadly the vague term "facilitate" might possibly be interpreted (especially by the U.S. Government!) There's belief in some infosec circles that this even means that, for example, a consultant who told a ransomware victim, "yeah, you should probably pay if you want your data back" might be considered liable. -- [0]: https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20201001 https://home.treasury.gov/policy-issues/financial-sanctions/... [1]: https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a... (PDF)