3 ms·

From personal experience, if you're building things that have itar restrictions, you just don't hire people that are in other countries.

by bagels 4y ago

toss1 4y ago
Indeed, and beyond that, you are restricted from even DISCUSSING of SENDING any info to any party that is not authorized under the Joint Certification Program (JCP), and there are databases to check whether a person or program is authorized It is sad to see all these upstream comments that are plainly ignorant and advocating either some ideal of free info exchange, or that it is not possible to contain the info because once it is in the commercial domain, everyone must have it. While it is almost certain that there will be some leaks in almost any containment system, it is a massive fallacy to assume that therefore all efforts to contain tech transfer are futile. I've literally watched as likely agents from adversary nations attempted in public forums to get even mid-level tech info in my field. It all seemed very collegial until the source of the requests was noticed to be Iran and they were shut down. Yes, this does often result in 'false positives' and restrict technology transfer to a harmless person. Maybe that guy really was just some student trying to learn (or, more likely, he was well funded and trying to get info for their drone program which is literally at this moment killing people in a democratic nation). Too bad — the possible benefit isn't even in the same orders of magnitude from the potential harm. The expansionist authoritarian nations (Russia, Iran, China, NK, etc.) are literally waging war against the democracies of the world. We need to treat it as such. Yes, there are sincere colleagues behind those borders. The best we can do is to help them escape their awful governments. Helping them, and their awful governments advance only increases the risk that those awful governments will also rule us.
- ryandrake 4y ago
  What about the many things that do not fall under ITAR? The NSA recently awarded[1] a $10B contract to Amazon Web Services. I don't think AWS was built entirely by Americans. US military routinely purchases commercial off the shelf products and services, and I doubt there is any effort to ensure they all were made entirely by US Citizens. I work along side of Russians, Iranians, and Chinese teammates (no North Koreans, to my knowledge). I wonder how they would feel if my company decided to sell their widgets or services to the US Military, where those things could plausibly be used against their own families? https://www.wsws.org/en/articles/2022/05/27/qemh-m27.html https://www.wsws.org/en/articles/2022/05/27/qemh-m27.html
  - skissane 4y ago
    AWS has a dedicated environment (GovCloud) for US government use. Only US citizens and green card holders are eligible to be granted access to it. They don't (in my personal experience) seem to be concerned about the nationality of the developers – but if the developer is non-US, they won't be able to gain any access to the production instance. They have to hand the app over to a US person who will be responsible for installing/configuring/operating it. Sometimes (especially when there is a problem), the non-US developer may be telling the US SRE/sysadmin/etc what command to type, but still a US person has to be the one doing the typing. And that's just non-classified systems, for classified systems the rules are even tougher. I remember once a colleague was writing some code on a classified project (actually for the Australian government, but this story could just as easily have happened in the US) to call some API, he told me he was having some problems. I asked him if he could show me his code. "Sorry, I can't, it is classified." "How can your code to call that API be classified?" "Everything we write while on-site is automatically classified, and trying to get it declassified is too hard". He agreed he'd go home, and rewrite the problematic code from memory, and then give that to me. In the process of doing so, he worked out what he was doing wrong, he didn't need my help in the end.
  - deleted 4y ago
    [deleted]
  - toss1 4y ago
    Indeed, there is plenty of stuff that is non-ITAR. ITAR, AFAIK, is basically for more advanced tech. There is also a set of information that is not classified, but is called Controlled Unclassified Information. That info, designs, drawings, specs, tech data, etc. is all controlled, even though it is not "classified". Same restrictions — must check first before communicating any of it to a non-US person or organization. It is a bit of a PITA when we need to make parts as a subcontractor that are CUI, but need to send those out for another process like painting or coating, to a non-JCP/ITAR-registered org. Funny that we can send the part, but not the drawings. I'm sure there's plenty of nonclassified and non-CUI non-ITAR stuff. The first thing that comes to mind is clothing, food, basic transport vehicles, fuel, etc.

From personal experience, if you're building things that have itar restrictions, you just don't hire people that are in other countries.

by bagels 4y ago

From personal experience, if you're building things that have itar restrictions, you just don't hire people that are in other countries.

toss1 4y ago

Indeed, and beyond that, you are restricted from even DISCUSSING of SENDING any info to any party that is not authorized under the Joint Certification Program (JCP), and there are databases to check whether a person or program is authorized It is sad to see all these upstream comments that are plainly ignorant and advocating either some ideal of free info exchange, or that it is not possible to contain the info because once it is in the commercial domain, everyone must have it. While it is almost certain that there will be some leaks in almost any containment system, it is a massive fallacy to assume that therefore all efforts to contain tech transfer are futile. I've literally watched as likely agents from adversary nations attempted in public forums to get even mid-level tech info in my field. It all seemed very collegial until the source of the requests was noticed to be Iran and they were shut down. Yes, this does often result in 'false positives' and restrict technology transfer to a harmless person. Maybe that guy really was just some student trying to learn (or, more likely, he was well funded and trying to get info for their drone program which is literally at this moment killing people in a democratic nation). Too bad — the possible benefit isn't even in the same orders of magnitude from the potential harm. The expansionist authoritarian nations (Russia, Iran, China, NK, etc.) are literally waging war against the democracies of the world. We need to treat it as such. Yes, there are sincere colleagues behind those borders. The best we can do is to help them escape their awful governments. Helping them, and their awful governments advance only increases the risk that those awful governments will also rule us.

ryandrake 4y ago
What about the many things that do not fall under ITAR? The NSA recently awarded[1] a $10B contract to Amazon Web Services. I don't think AWS was built entirely by Americans. US military routinely purchases commercial off the shelf products and services, and I doubt there is any effort to ensure they all were made entirely by US Citizens. I work along side of Russians, Iranians, and Chinese teammates (no North Koreans, to my knowledge). I wonder how they would feel if my company decided to sell their widgets or services to the US Military, where those things could plausibly be used against their own families? https://www.wsws.org/en/articles/2022/05/27/qemh-m27.html https://www.wsws.org/en/articles/2022/05/27/qemh-m27.html
- skissane 4y ago
  AWS has a dedicated environment (GovCloud) for US government use. Only US citizens and green card holders are eligible to be granted access to it. They don't (in my personal experience) seem to be concerned about the nationality of the developers – but if the developer is non-US, they won't be able to gain any access to the production instance. They have to hand the app over to a US person who will be responsible for installing/configuring/operating it. Sometimes (especially when there is a problem), the non-US developer may be telling the US SRE/sysadmin/etc what command to type, but still a US person has to be the one doing the typing. And that's just non-classified systems, for classified systems the rules are even tougher. I remember once a colleague was writing some code on a classified project (actually for the Australian government, but this story could just as easily have happened in the US) to call some API, he told me he was having some problems. I asked him if he could show me his code. "Sorry, I can't, it is classified." "How can your code to call that API be classified?" "Everything we write while on-site is automatically classified, and trying to get it declassified is too hard". He agreed he'd go home, and rewrite the problematic code from memory, and then give that to me. In the process of doing so, he worked out what he was doing wrong, he didn't need my help in the end.
- deleted 4y ago
  [deleted]
- toss1 4y ago
  Indeed, there is plenty of stuff that is non-ITAR. ITAR, AFAIK, is basically for more advanced tech. There is also a set of information that is not classified, but is called Controlled Unclassified Information. That info, designs, drawings, specs, tech data, etc. is all controlled, even though it is not "classified". Same restrictions — must check first before communicating any of it to a non-US person or organization. It is a bit of a PITA when we need to make parts as a subcontractor that are CUI, but need to send those out for another process like painting or coating, to a non-JCP/ITAR-registered org. Funny that we can send the part, but not the drawings. I'm sure there's plenty of nonclassified and non-CUI non-ITAR stuff. The first thing that comes to mind is clothing, food, basic transport vehicles, fuel, etc.