The Bureau of Industry and Security (BIS) has added five Russian entities to the Entities List that are now prohibited from doing business with the United States because they are involved in activities contrary to the national security or foreign policy of the United States. This is meant to be a tongue-in-cheek reminder that the Federal government has export licensing requirements and the failure to follow these requirements results in a ban on doing any import/export-related business. These entities violated the Government's Export Administration Regulations when they engaged in illegal hacking operations.

EXPORT ADMINISTRATION REGULATIONS

The law, the Export Administration Regulations or EAR, imposes licensing requirements on exports, reexports, and transfers (in-country) to persons or entities listed on the Entity List. Entities are placed on the list by the BIS based on certain sections of part 744 (Control Policy: End-User and End-Use Based) and part 746 (Embargoes and Other Special Controls) of the EAR.

In this case, because of the recently reported Russian hacking activities, the End-User Review Committee (ERC), composed of representatives of the Departments of Commerce (Chair), State, Defense, Energy, and Treasury, met and unanimously voted to add five Russian entities to the list. The legal basis for adding these entities to the list was a violation of Executive Order 13694 that allows the Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities.

However, when it comes to importing and exporting, you don't have to be a Russian hacker to violate EAR. In fact, businesses often may not even know about the existence of the EAR regulations before they violate them. And, a violation is strictly construed, meaning a business does not have to have intended to violate the regulation to be liable criminally or civilly (and the penalties are significant).

To learn more about the recent U.S. action you can visit the Federal Register's website.