US Shuts Down Open Source 'Help' from These Countries
On Wednesday, the Linux Foundation highlighted the challenges posed by "regulatory compliance" and "increased cybersecurity risk" that open source communities must address. As Steven J. Vaughan-Nichols noted, the foundation has released a comprehensive guide to assist open source developers in navigating the intricate regulations set forth by the U.S. Office of Foreign Assets Control (OFAC) sanctions. These regulations aim to fulfill economic, foreign policy, and national security objectives and impact various interactions within the open source community.
The total list of Sanctions Programs and Countries encompasses over 17,000 entries, which include individuals, terrorist organizations, and entire nations. This issue came to the forefront in October 2024 when the Linux kernel developers faced a significant challenge. The leadership team, including Greg Kroah-Hartman, the stable Linux kernel maintainer, and Linus Torvalds, the founder of Linux, announced the removal of eleven Russian kernel developers from their roles. Torvalds cited "Russian sanctions" as the reason, emphasizing in a message on the Linux kernel mailing list (LKML) that "the 'various compliance requirements' are not just a US thing."
For developers, this situation necessitates caution regarding collaboration and contributions from sanctioned regions. The sanctions target specific countries, regions, and individuals or organizations, many of which are listed on the Specially Designated Nationals and Blocked Persons (SDN) List. While most OFAC sanctions allow for "informational materials," which generally encompass existing open source code, this exemption does not extend to requests for new code or modifications. For instance, collaborating with a Russian developer on a code patch could lead to legal complications.
Reviewing unsolicited patches from contributors in sanctioned regions is typically acceptable; however, actively engaging with them for discussions or improvements might breach legal boundaries. Developers are advised to be vigilant about sanctioned entities attempting to contribute indirectly through third parties or individual developers.
Currently sanctioned countries include Russia, Cuba, Iran, North Korea, Syria, and certain regions of Ukraine: Crimea, Donetsk, and Luhansk. The Linux Foundation has stressed that OFAC sanctions rules are "strict liability" rules, meaning that ignorance of the regulations does not exempt one from penalties. Violating these rules can result in serious consequences, making it crucial for developers to understand how these regulations might impact their open source efforts.
Heather Meeker, an attorney specializing in open source licensing, provided insight into the situation, stating, "Let's be honest: Smaller companies usually ignore regulations like this because they just don't have the resources to analyze them, and a government usually ignores smaller companies because it doesn't have the resources to enforce against them. Big companies that are on the radar need specialized counsel."
Post a Comment