[author: Tatiana Follett1, Summer Associate]
Introduction
In February 2023, the Department of Justice (DOJ) announced the creation of the Disruptive Technology Strike Force (strike force) in conjunction with the Department of Commerce to protect against the illegal export of U.S. technology to “nation-state adversaries.”2 In particular, the strike force is concerned that the technology can be used “in novel ways to enhance [adversaries’] military capabilities or support mass surveillance programs ...”3 For example, the DOJ states that materials typically used for commercial purposes in the U.S., such as advanced manufacturing equipment or artificial intelligence, can be used for “disruptive purposes, such as improving calculations in weapons design and testing ...”4
Just three months later the strike force took its first actions towards enforcement and filed five cases against six individuals who are accused of providing technology and/or goods to China, Russia, and Iran. In each of the cases, the nationals are alleged to have deceived U.S. companies or organizations as part of their activities.
The Cases
The cases can be broadly classified into three categories: selling sensitive technology to companies based in the People’s Republic of China (PRC), exporting weapons technology and other goods to Russia, and using PRC-based companies to provide materials used for Weapons of Mass Destruction (WMD) to Iran in exchange for payments via the U.S. financial system.
In U.S. v. Wang and U.S. v. Li, the government alleges that defendants Wang and Li stole sensitive technology from their employers without the employers’ knowledge.5 Wang, a former employee of Apple, is accused of accessing and storing large quantities of data related to his work on autonomous systems after signing an employment agreement with a PRC-based company developing self-driving cars.6 Wang allegedly stole this data despite Apple’s efforts to prevent technology sharing by requiring employees to sign a confidentiality agreement, offering in-person secrecy training covering handling of confidential information, and prohibiting transfer of intellectual property without Apple’s consent.7 Similarly, Li is accused of sharing information and services with PRC-based companies related to work he did on three dimensional models.8 Li worked for two companies between 1996-2019.9 In 2018, Li and his wife started a company entitled JSL Innovations.10 Li allegedly used JSL Innovations to provide technology and technology services from his previous employers to PRC companies.11
In U.S. v. Bogonikolos and U.S. v. Besedin & Ptasulya, the DOJ alleges these individuals and their companies deceived U.S.-based companies and provided American technology to Russian weapons and airline organizations.12 Bogonikolos, the former head of a collection of defense and technology companies in the Netherlands and Greece, is accused of smuggling “U.S.-origin military and dual-use technologies to Russia.”13 In part, Bogonikolos gave false end-use statements to U.S. companies claiming that the technology would not be reexported and would not be used for weapons development.14 Besedin and Ptasulya are two Russian nationals who used their Florida-based company to export U.S. aircraft parts to Russian airlines in violation of export sanctions.15 Besedin and Ptsaulya lied to the U.S. suppliers about where the products were going and who the end-users would be.16 The investigations of Bogonikolos, Besedin, and Ptasulya were carried out with the help of the DOJ’s KleptoCapture task force, which is “dedicated to enforcing sanctions, export controls and economic countermeasures imposed in response to Russia’s unprovoked military invasion of Ukraine.”17
In U.S. v. Qiao, the DOJ accuses a Chinese citizen of using a Chinese company under U.S. sanctions to provide material used in WMD production to Iran in exchange for payments made via a U.S. bank account.18 Qiao opened a bank account under the name of a front company and allegedly accepted over $15,000 in payments.19
Protecting Your Business Against Export Violations and Fraud
Although changing export regulations and increased monitoring can be difficult to navigate, there are several steps organizations can take to mitigate any risk of the unauthorized sharing of sensitive technology and/or violating export control laws. Some ways to protect company operations include:
- Develop a “red flag” protocol to mark potentially risky transactions, information, or data “that arises through any source where follow-up, assessment, and/or further due diligence is warranted.”20 Establishing objective criteria by which certain actions should be marked provides for swift and reliable identification of risky situations which may result in unlawful data sharing.
- Instruct employees to consider the capabilities of the product or service the company provides, including all possible uses of the product or service.21 Increasing employees’ awareness of the issues – and consequences – of handling and sharing sensitive information can create a first line of defense against unlawful exports and unintended sharing of information with hostile nation-states.
- Thoroughly vet employees who have access to secure technology and establish safeguards to continually monitor technology use and sharing. As the cases above illustrate, training on safe use of technology may not be sufficient. Employers should establish systems by which technology and its data use and dispersing are regularly monitored for compliance with company policy and with applicable regulations.
- Consider using outside counsel to help ensure the organization is adhering to increasing scrutiny, and a rapidly changing export environment. Outside counsel allows companies to investigate business activity under attorney-client privilege, provides the independence of a credible third party, and could facilitate remediation or government engagement if appropriate. Using outside counsel can help companies gain objective and thorough insight on their activities, including protocols which could be strengthened to protect against unlawful data sharing.
Footnotes:
