{"id":121679,"date":"2025-02-02T21:46:00","date_gmt":"2025-02-02T19:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rekomendaczii-linux-foundation-po-soblyudeniyu-sankczij-v-otkrytyh-proektah"},"modified":"2025-02-02T21:46:00","modified_gmt":"2025-02-02T19:46:00","slug":"rekomendaczii-linux-foundation-po-soblyudeniyu-sankczij-v-otkrytyh-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/rekomendaczii-linux-foundation-po-soblyudeniyu-sankczij-v-otkrytyh-proektah","title":{"rendered":"Linux Foundation's Recommendations for Compliance with Sanctions in Open Projects","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Linux Foundation has published an analysis of the applicability of sanctions imposed to open code, summarized the arising risks, and provided recommendations for those maintaining open projects associated with the involvement of individuals subject to sanctions. <\/p>\n
The Linux Foundation continues to advocate for international cooperation and an open ecosystem for all interested parties, regardless of nationality, country of residence, political system, cultural values, and ideology. At the same time, the organization operates within U.S. law and is obligated to comply with laws and regulations wherein the perception of neutrality and equality in open source may differ from the interpretation of many individuals. <\/p>\n
Uncertainty arises regarding the sanctions imposed by the U.S. Office of Foreign Assets Control (OFAC). OFAC sanctions apply to individuals, organizations, or companies added to the Specially Designated Nationals and Blocked Persons (SDN) list, as well as to their affiliates (for example, companies where 50 percent or more is directly or indirectly owned by an individual on the sanctions list). <\/p>\n
It is noted that while developing restrictive laws in recent years, such as the Cyber Resilience Act, advocacy groups representing open source interests have sought exceptions that mitigate the application of these laws concerning open projects. The legislative framework for OFAC sanctions was established a long time ago and did not take into account the specifics of joint international development of open source, and until recently, did not create problems for open source developers, as OFAC sanctions were used in rare exceptional cases. <\/p>\n
No official clarifications have been published on the application of OFAC sanctions requirements to open projects, so lawyers have to interpret the requirements based on past applications of sanctions in similar contexts and proceed cautiously, balancing the desire to maintain the global nature of development with emerging risks such as hefty fines and criminal prosecution. In addition to OFAC sanctions, export restrictions imposed by the U.S. Department of Commerce under export control laws also apply. These restrictions do not apply to publicly available developments and therefore do not create problems for open projects. <\/p>\n
OFAC sanctions requirements apply not only to U.S. companies and citizens but also to foreign companies that have trade relations with U.S. companies or conduct financial transactions in U.S. dollars. For individuals added to the OFAC sanctions list, restrictions such as a ban on investments and financial transactions (including payment for services); a ban on the import and export of goods, technologies, and services; and a ban on property transactions (including those related to intellectual property) are imposed. <\/p>\n
Companies and organizations developing international open projects and falling under U.S. jurisdiction or interacting with U.S. companies are given the following recommendations: <\/p>\n
\n
The OFAC sanctions include an exception that applies to the distribution of informational materials. Source code is generally considered by OFAC as informational material, allowing for the unilateral provision of source code.\n
Receiving changes from individuals associated with sanctioned companies is permitted if such changes are initiated by the sender (not requested) and address common project issues rather than benefiting products or services of the sanctioned company. For example, accepting a driver for hardware produced by a sanctioned company into the Linux kernel may be viewed as a violation of sanctions, whereas accepting a patch that fixes a vulnerability does not violate sanctions.\n
In the case of receiving corrections from a sanctioned company, it is recommended to maintain one-sided communication, meaning all further development of the accepted patch should be carried out independently, without involving the sanctioned company. Involvement of the sanctioned company in development, approval, or discussion may be interpreted as the provision of services prohibited by sanctions.\n
It is not advisable to sign agreements on the transfer of property rights (CLA) with developers associated with sanctioned companies, as such an agreement may be perceived as a violation of the prohibition on agreements in the field of intellectual property.\n
It is necessary to check not only the direct connection of developers with sanctioned companies, but also their indirect relations. For example, working in other companies that are 50% or more owned by sanctioned individuals, or performing contract work for sanctioned companies. <\/ul>\n