5 ms·

If this were not just an utterly meaningless exercise, every single person that has ever worked at or with the NSO group should be blacklisted and untouchable t

If this were not just an utterly meaningless exercise, every single person that has ever worked at or with the NSO group should be blacklisted and untouchable to send an actual signal and make the consequences of participating in such activities actually meaningful and consequential.

FDSGSG 5y ago
This has some meaningful consequences. It makes NSO and any money that has touched NSO poisonous. It's not illegal to touch, but few banks will want to work with you. If you're an employee receiving salary payments from NSO, expect your bank to be unhappy with you.
- lordofgibbons 5y ago
  I think you might be mixing up trade imbargo with a sanction.
  - FDSGSG 5y ago
    Of course not, I'm simply pointing out that this certainly places you in the "super high risk" category as far as any KYC procedures go.
  - tyingq 5y ago
    Perhaps confusing it with the OFAC list, which is directly about banking and blocking transactions for named entities and individuals.
    - FDSGSG 5y ago
      Not confusing with the OFAC list. Being on any list makes you a toxic customer. Yes, there are other designations which would carry even worse repercussions.
  - JumpCrisscross 5y ago
    > I think you might be mixing up trade imbargo with a sanction Being employed, or even having been employed, by an entity on the BIS's Entity List will make doing business in U.S. and in U.S. dollars expensive and tedious. At the very least, you will impose ongoing additional costs for every financial institution you interact with.
- bberenberg 5y ago
  That isn't what the Entity List does. See https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern/entity-list https://www.bis.doc.gov/index.php/policy-guidance/lists-of-p...
  - funnyflamigo 5y ago
    Does this mean you can still work with them, you just require a license first?
    - deleted 5y ago
      [deleted]
  - FDSGSG 5y ago
    This is very much what the entity list does in practice. Any company listed on the entity list is an incredibly high risk client. Just like a NYT article accusing you of being a terrorist does not carry any official repercussions, it will certainly ruin your banking relationships.
    - bberenberg 5y ago
      I don't know enough about this topic, can you show any evidence of this? Maybe through a bank's policy docs or something along those lines?
      - FDSGSG 5y ago
        I can't show evidence, but I don't have to because this is incredibly obvious to anyone with basic banking experience. FWIW It is practically illegal for banks to discuss their AML/KYC practices, nobody is going to go into detail about this.
      - jcrawfordor 5y ago
        It's a very well-understood aspect of the financial industry that banks use a combination of in-house departments and outside providers to perform background research on their clients. The depth and breadth of this research depends on the size of the financial relationship. Things like searching for domestic and foreign news articles that mention the client, and particularly flagging any that indicate a suspect business history or suspect relationships, is basically a minimum requirement for a significant client under today's AML/KYC framework. It's almost explicitly required since there are regulatory requirements pertaining to politically exposed persons (PEPs), and the standards for identification of PEPs directly relate to public profile. i.e. if you are frequently mentioned in the newspaper, even purely positively, a bank is going to have to perform additional diligence. Since checking all manner of sanction, exclusion, risk, etc. lists published by the government is trivially automatable it is basically a minimum standard, and even the simplest KYC systems are going to flag customers that appear on any of these. For more significant clients additional databases and analyst resources will be used that are likely to uncover a relationship with such entities, especially a simple and easy to check one like prior employment. This is a world with few black and white rules, and banks are mostly not outright prohibited from providing services to high-risk customers. But higher and higher levels of approval will be required, and the bank will have to go into the situation knowing that they will incur extra costs in terms of analyst time, compliance work, and ultimately liability of potentially huge amounts of money. It will be difficult, although maybe not impossible, to convince a bank to work with you. Everything will end up costing you more. You will have to be very cautious because banks will sometimes change their risk evaluations and decide to terminate the relationship, and you will have to figure out how to start your banking relationship over somewhere else. While all of this is required under various laws (federally things like the BSA, PATRIOT act, etc), statutes are intentionally vague about the requirements both because banks are encouraged (and pretty much required) to perform internal research and development to improve their AML/KYC methods, and because the system operates in part on secrecy - bank clients need to not know how AML/KYC analysis works in much detail or they may find a way to structure around it. Banks also share information with each other and with governments, much of which is done under strict confidentiality agreements for several different reasons. Banks that get this wrong can lose hundreds of millions and occasionally even billions of dollars, so there's a lot of hesitance to take on risk. It's also generally perceived that enforcement is becoming more aggressive over time, not less.
eli 5y ago
It means, among other things, that no US company or person can sell them technology or offer technical services under threat of significant penalty. How is that meaningless?
- shlurpy 5y ago
  Companies can be disbanded and reformed. The people in charge can distance themselves from the "failed" attempt and make a new, nonblacklisted one. That's why punishment and blacklisting has to extend to decision-makers, rather then flimsy symbolic entities.
  - eli 5y ago
    In this hypothetical, creating a new entity seems like a fair bit of work, but adding the new entity to the list so it faces the same controls is trivial. What am I missing? I certainly wouldn't send technology subject to export control to anyone I knew to be a part of NSO Group or any successor.
    - shawnz 5y ago
      If this was done as a reaction to changing public opinion and not genuine concern, then it will be a while before public opinion catches up with the new entity.
      - alwayseasy 5y ago
        I doubt the people at the US Treasury would be blind to such an obvious maneuver. Not matter what the public opinion says I think they won't let NSO try and evade their blacklist.
  - JumpCrisscross 5y ago
    > Companies can be disbanded and reformed This is the U.S. Treasury. The concerns you're worried about have been contemplated.

FDSGSG 5y ago

This has some meaningful consequences. It makes NSO and any money that has touched NSO poisonous. It's not illegal to touch, but few banks will want to work with you. If you're an employee receiving salary payments from NSO, expect your bank to be unhappy with you.

lordofgibbons 5y ago
I think you might be mixing up trade imbargo with a sanction.
- FDSGSG 5y ago
  Of course not, I'm simply pointing out that this certainly places you in the "super high risk" category as far as any KYC procedures go.
- tyingq 5y ago
  Perhaps confusing it with the OFAC list, which is directly about banking and blocking transactions for named entities and individuals.
  - FDSGSG 5y ago
    Not confusing with the OFAC list. Being on any list makes you a toxic customer. Yes, there are other designations which would carry even worse repercussions.
- JumpCrisscross 5y ago
  > I think you might be mixing up trade imbargo with a sanction Being employed, or even having been employed, by an entity on the BIS's Entity List will make doing business in U.S. and in U.S. dollars expensive and tedious. At the very least, you will impose ongoing additional costs for every financial institution you interact with.
bberenberg 5y ago
That isn't what the Entity List does. See https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern/entity-list https://www.bis.doc.gov/index.php/policy-guidance/lists-of-p...
- funnyflamigo 5y ago
  Does this mean you can still work with them, you just require a license first?
  - deleted 5y ago
    [deleted]
- FDSGSG 5y ago
  This is very much what the entity list does in practice. Any company listed on the entity list is an incredibly high risk client. Just like a NYT article accusing you of being a terrorist does not carry any official repercussions, it will certainly ruin your banking relationships.
  - bberenberg 5y ago
    I don't know enough about this topic, can you show any evidence of this? Maybe through a bank's policy docs or something along those lines?
    - FDSGSG 5y ago
      I can't show evidence, but I don't have to because this is incredibly obvious to anyone with basic banking experience. FWIW It is practically illegal for banks to discuss their AML/KYC practices, nobody is going to go into detail about this.
    - jcrawfordor 5y ago
      It's a very well-understood aspect of the financial industry that banks use a combination of in-house departments and outside providers to perform background research on their clients. The depth and breadth of this research depends on the size of the financial relationship. Things like searching for domestic and foreign news articles that mention the client, and particularly flagging any that indicate a suspect business history or suspect relationships, is basically a minimum requirement for a significant client under today's AML/KYC framework. It's almost explicitly required since there are regulatory requirements pertaining to politically exposed persons (PEPs), and the standards for identification of PEPs directly relate to public profile. i.e. if you are frequently mentioned in the newspaper, even purely positively, a bank is going to have to perform additional diligence. Since checking all manner of sanction, exclusion, risk, etc. lists published by the government is trivially automatable it is basically a minimum standard, and even the simplest KYC systems are going to flag customers that appear on any of these. For more significant clients additional databases and analyst resources will be used that are likely to uncover a relationship with such entities, especially a simple and easy to check one like prior employment. This is a world with few black and white rules, and banks are mostly not outright prohibited from providing services to high-risk customers. But higher and higher levels of approval will be required, and the bank will have to go into the situation knowing that they will incur extra costs in terms of analyst time, compliance work, and ultimately liability of potentially huge amounts of money. It will be difficult, although maybe not impossible, to convince a bank to work with you. Everything will end up costing you more. You will have to be very cautious because banks will sometimes change their risk evaluations and decide to terminate the relationship, and you will have to figure out how to start your banking relationship over somewhere else. While all of this is required under various laws (federally things like the BSA, PATRIOT act, etc), statutes are intentionally vague about the requirements both because banks are encouraged (and pretty much required) to perform internal research and development to improve their AML/KYC methods, and because the system operates in part on secrecy - bank clients need to not know how AML/KYC analysis works in much detail or they may find a way to structure around it. Banks also share information with each other and with governments, much of which is done under strict confidentiality agreements for several different reasons. Banks that get this wrong can lose hundreds of millions and occasionally even billions of dollars, so there's a lot of hesitance to take on risk. It's also generally perceived that enforcement is becoming more aggressive over time, not less.

eli 5y ago

It means, among other things, that no US company or person can sell them technology or offer technical services under threat of significant penalty. How is that meaningless?

shlurpy 5y ago
Companies can be disbanded and reformed. The people in charge can distance themselves from the "failed" attempt and make a new, nonblacklisted one. That's why punishment and blacklisting has to extend to decision-makers, rather then flimsy symbolic entities.
- eli 5y ago
  In this hypothetical, creating a new entity seems like a fair bit of work, but adding the new entity to the list so it faces the same controls is trivial. What am I missing? I certainly wouldn't send technology subject to export control to anyone I knew to be a part of NSO Group or any successor.
  - shawnz 5y ago
    If this was done as a reaction to changing public opinion and not genuine concern, then it will be a while before public opinion catches up with the new entity.
    - alwayseasy 5y ago
      I doubt the people at the US Treasury would be blind to such an obvious maneuver. Not matter what the public opinion says I think they won't let NSO try and evade their blacklist.
- JumpCrisscross 5y ago
  > Companies can be disbanded and reformed This is the U.S. Treasury. The concerns you're worried about have been contemplated.