A Warning to Know Your Customer: Computerlinks Fined for Dealing Blue Coat Surveillance Technology to Syria

The world learned in 2011 that a U.S. company's Internet censorship and surveillance technology is in the hands of the Syrian government. This was notable because Syria is under heavy sanctions by the U.S. government—meaning there’s no way that it was legal for Syria to end up with this American-made hardware and software.  While the tech firm, Blue Coat Systems, initially denied knowledge of the sale (which was uncovered by activists at Telecomix and elsewhere), the U.S. Department of Commerce nonetheless launched an investigation into how their equipment found its way into the country.

The recently released investigation confirms our previous recommendation that companies selling surveillance and censorship technologies absolutely must take steps to know their customer and that this must mean identifying the actual ultimate purchaser of a product even when there is a middleman, or multiple middlemen. Without it, their products can and will fall into the hands of authoritarian regimes.

Last month, the U.S. Department of Commerce revealed that Computerlinks FZCO, the Middle East/North African division of the multinational Computerlinks AG, was the middleman between Blue Coat and the Syrian government. The resulting order, published on April 25, 2013 by the Bureau of Industry and Security (BIS) details how Computerlinks violated export laws three times, ultimately selling tools worth $1.4 million to Syria to spy on its people.  Computerlinks settled with BIS for a $2.8-million fine. 

We also now know that 18 separate IT companies (including big names such as EMC, Symantec and McAfee) are continuing to contract with Computerlinks FZCO, even though the company was just penalized for breaking the Syrian trade embargo.

Some Background

In 2011, the hacktivist group Telecomix released evidence that Internet surveillance and censorship products developed by Silicon Valley-based Blue Coat were in use in Syria.  At first Blue Coat pleaded ignorance, but later confirmed to the Wall Street Journal that at least 13 of the ProxySG appliances destined for other nations ended up in Syria. 

Blue Coat conducts overseas dealings through third-party distributors or "channel partners." As the channel partner in this case, the Dubai branch of Computerlinks told Blue Coat the technology was being sold to the Iraq Ministry of Telecom and LiwalNet, an ISP in Afghanistan.

While it is legal to sell certain technologies to Iraq and Afghanistan, neither of these countries is a model of openness and transparency.  For example, a bill proposed in Iraq last year would have imposed mandatory life sentences for certain computer “crimes.”

But Computerlinks didn’t sell to Iraq or Afghanistan; rather, it used yet another middleman to sell Blue Coat’s technology to the state-run Syrian Telecommunications Establishment—not once, but on three separate occasions. In at least one documented instance, Computerlinks knew it was providing tech support that was designed to help Syria monitor the Web activities of individual users and prevent users from circumventing censorship controls.

In December 2011, the BIS added the go-between, Waseem Jawad of Infotec/Info Tech, to the BIS Entity List, which means he can no longer sell American goods. Computerlinks FZCO now must pay the statutory maximum fine, plus submit to mandatory independent audits.

"Today’s settlement reflects the serious consequences that result when companies evade U.S. export controls," Under Secretary for Industry and Security Eric L. Hirschhorn said in a press statement. "It is the result of an aggressive investigation and prosecution by BIS of the unlawful diversion of U.S. technology to Syria. It is vital that we keep tech