 Good morning and welcome Welcome attendees and panelists and folks on the live stream to the new America Foundation for those who don't know me I am as of two weeks ago the new policy director at the open technology Institute here at new America Foundation If you're not familiar new America is a non-partisan think tank that invests in new thinkers and new ideas to address the next generation of challenges facing the United States both domestically and internationally Our experts work on a wide range of issues including education national security technology policy Telecom policy and at the open technology Institute We bring together policy experts technologists and practitioners to tackle challenges Like promoting ubiquitous safe and affordable access to communications technologies in communities in the United States and around the world Today's topic is central to OTI's mission We are here today to talk about access to personal communications tools in some of the most repressive countries in the world Iran Sudan Syria Cuba and North Korea and how US sanctions Impact ordinary citizens ability to talk to each other and to access unfiltered information on one hand today's event is the culmination of Nearly a year's worth of work on the issue Much of which has taken place behind the scenes in private meetings with government officials tech companies And of course human rights activists and civil society advocates at the same time though We hope that this will be the beginning of a more public conversation About how US policies can be strengthened to reflect and promote the values of internet freedom in sanctioned countries Yesterday we released a new report translating norms to the digital age technology and the free flow of information under US sanctions and that paper looks at The growing trend of authorizations that make it legal for American companies to export Their personal communications technologies and tools to countries that are subject to comprehensive us sanctions Today we're going to talk about some of the observations we made in that report and the recommendations We put together for creating better policies going forward The discussion is going to focus mostly on Iran Which has the most mature technology carve-outs right now and on Sudan where nonviolent protesters are increasingly relying on digital tools to communicate and organize an Indication that now could be the time for a policy shift geared toward helping the Sudanese citizens and increasing pressure on that regime So our panelists They bring in a mix of experience and perspectives from the situation on the ground in Iran and Sudan to the regulatory challenges and the risk that companies face when they're trying to navigate these sanctions regimes So a few housekeeping items first today's event is being live streamed and a recording of the panel will be available on the new America website after the event Also, for those of you in the room and watching online We'd encourage you to continue the discussion on Twitter using the hashtag tech sanctions With those housekeeping things out of the way, let me turn things over to our moderator OTI program associate Danielle Keele who along with OTI policy analyst Tim Maher who is joining us in the back of the room And in turn Sonya Fiend who could not join us today Author of the paper we released today On a personal note, I just want to say I'm very excited to be working with such a great team Who based on just a couple of weeks of experience? I expect will continually be making me look really good by virtue of the incredible work that they're producing So, please I invite you to join me in thanking them and creating their hard work and joining me in welcoming our panelists today Thank you for that introduction Kevin And first I want to echo the warm welcome to everybody here in the room and as well as those who are watching us always on the live stream We're really glad to have you here Also a big note of thanks and you'll see this in the paper and the acknowledgments and on the website Which is that while Tim and Sonya and I you know put together this report? It's certainly something that couldn't have we would never have been able to put together without Incredible contributions from a number of different people and that's folks in the government who who gave us really good feedback and advice as well as civil society advocates and human rights activists and Representatives of companies and a lot of those a lot of you are in the room today So I want to thank you especially for your work for reading drafts for everything that you did So thank you and with that I'll do a brief introduction and then we'll we'll we'll get to it as As Kevin explained the topic that we're talking about today is a is both a complicated one and I think a very important one Broadly the issue is about the ability of people in sanctioned countries in repressive countries and really all over the world To communicate and to access information And increasingly that requires the ability to access digital tools and personal communications technology So over the past year here at OTI we've been Focusing on the impact of sanctions on people's access to these tools a lot of that work As Kevin alluded to has been the necessary outreach to the government officials to representatives of companies And to of course, you know civil society advocates to really try to get to understand the nuances and in the report We we take a look at our sanctions policies through and the communications exemptions through the lens of what we consider to be a similar process of targeted sanctions reform in the 1990s And the goal of this this idea of targeted sanctions is to maximize the cost of Sanctions to the target regime so so to put pressure on the regime while minimizing the unintended negative consequences on the population That's one of the reasons why today we have carve-outs for humanitarian goods like food and medicine in our sanctions programs So looking at the evolution of the authorizations for communications tools over the past few years We see a similar trend what began with references to internet freedom And exemptions for informational materials Has evolved into a much more mature system of authorizations for personal communications tools This is particularly true when you look at Iran. That's why that's one of the focuses of what we're going to discuss today At the same time not all our sanctions programs are not none of our sanctions programs are the same And so in the report we also examine the provisions that exist for Syria for Sudan for Cuba and North Korea What we found is a patchwork patchwork of complex provisions that are often unclear and they they make it difficult even for the companies that really want to make their products available that are trying to do the Right thing and to you know promote access in the free flow of information To make their products available to unblock them in these countries So we laid out a series of recommendations that we've developed over the past few months Not only to the US government, but also to private companies and of course civil society for how to strengthen and institutionalize the previous efforts At the center of the proposal is the extension of general licenses to the other sanctioned countries And it's based on the precedent that was established in general license D for Iran. It was issued in May of 2013 There's really no reason why US sanctions should be inadvertently doing the work of repressive governments Which is what they do now at times when they When when you see access to information and communications tools restricted because companies aren't sure If they can if they can export their products and we really think that there's a clear trend and a solid template for policy shift The general licenses though, of course, are just a first step And as we've learned over the past few years even once the policies are in place good and well-intentioned of policies There's a lot more work that needs to be done companies need to understand them Make sure that the products that they're trying to make available comply and then they actually have to take active steps to implement it And of course since we're talking about technology These are policies that have to be flexible In a few years we'll be facing. I'm almost certain a different technological reality. And so we need to be able to To update regulation and to to make changes that are appropriate. So anyway I won't bore you too much more with with the rest of with the details of what's in the report I hope you'll all to read it and We've got a great panel here today. So I'm eager to let them let them talk So I'll introduce everyone briefly and then they can tell you a little bit more about why they're here First we have Ian Shuler Ian is the founder of the new rights group and he's the former senior manager of the internet freedom programs at the US Department of State Next to Ian, we've got Colin Anderson. I think many of you know Colin Who's an internet researcher with a wide range of expertise? But one of the areas that Colin focuses on is Iran And so he can tell you about all things Iranian sanctions, but also Sudan sanctions Cuban sanctions Syrian sanctions Don't want to don't want to put him in a box there I Next we have Brad Brooks Rubin Brad is an attorney at Holland and Hart and he specializes in trade sanctions Export controls and international trade law. He's a former attorney advisor to the US Department of Treasury And a former special advisor for conflict diamonds with the US Department of State And last but not least we have Anwar da Fala Who is an assistant professor of computer science? He's the founder of TEDx cartoon and the founder of Nafir IT and I will with that. I will let them get to it Ian. You wanna sure well Yeah, Danielle asked us to each give you guys some idea of why you should care what we're why we're that we're here at all And then what our background is on the topic myself I was at the state as Danielle mentioned I was at the State Department between early 2011 and early 2013 At that time I was working at DRL the Bureau for Democracy Human Rights and Labor on internet freedom issues during the Clinton State Department the Time I was there. I was primarily focused on programs But sanctions was one issue while I was not on the policy team that was one issue where I was Involved in working on our policies at the time. So I came in after the initial General license for Iran Cuba and Sudan that was issued in 2010 But was involved in the process of writing or the process of crafting interpretive guidance and a statement of licensing policy in March 2012 Around the Nero's at the time and then was involved in some of the early Formulations of what might be appropriate for general license D. Although much of the heavy lifting on that policy move was took place after I left So that's my way of background I mean, I guess before we kind of kick it off into question a few things I would say One quick point for as far as framing is that I do think that there is certainly an interest in getting sanctions policy Right and a recognition that it is something that constantly needs to be looked at and reformed I think the barriers within government to getting the policy change aren't not necessarily a lack of Any sort of interest that's trying to keep it the way that it is or and not necessarily a Disagreement with the notion that Access to communications and information is incredibly important something that we should be for individuals in sanctioned countries is important Something we should be supporting there again in the time that I was there. There was a clear recognition of that as a Policy issue that we wanted to pursue but more the barriers tend to be That sanctions are so complicated that there's a lot of very specific technical information about The technologies themselves that are involved what's currently accessible and what is not and for what reason? and what are the legal instruments available to change the way think that things are being done currently and Frankly for a lot of that information. We really relied on people outside of the government to provide that information So that's an important thing for civil society to be doing and and companies to be doing and And why I was very happy to be part of this meeting today and to see the report come out because that was incredible Incredibly important in driving that sort of change and then the other part is you know and often the the the instant there are many Levers in government that need to be moved in order to move something that touches as many things as sanctions and export control policy Are involved and and so getting everybody aligned to make the changes that they need to make Does sometimes require a push when all of these people are putting out a lot of fires It's easier for to get the attention To for those who are interested in making these changes to get the momentum that they need if there is a bit of an external Push as well. And so I do think that you will find find Fertile ground for making change these sorts of changes, but but you may need to be the engine behind some of those movements so I Think I think what's not necessary is perhaps an introduction to the role that sanctions play and then to sort of walk from there To some of the legal responses that have happened and some of the ways in which we have a status in this field Because I think I think what's easy to miss is that we have this romantic notion of the role that technology plays in Countries that are undergoing either democratic transitions or internal political conflict Particularly given in the context of Iran I think we had particularly because of the mass media and the perception and that happened in the the Western press this notion that 2009's post-election demonstrations in in regard to Allegations of electoral fraud were a Twitter revolution But if we start to peel back and look at that notion and look at the technologies involved We see exactly for one why why it was not exactly that because if you look at that time in 2009 a vast majority of the Resources and technologies that we hold up as as being critical were blocked by one of two sources Either the Iranian government or US policy at the time if if we start to take a look for example We all know by well Well by now that Facebook and Twitter are blocked in Iran, but at the same time a substantial amount of the Google Earth Chrome Circumvention tools had quickly run up into encryption problems export problems that led to a restriction and availability and so as we see There were significant hurdles to actually any sort of Resource for political mobilization this becomes I think very quickly the impetus for the conversation that we have now and in much of the policy the reactions that were That stemmed from that as Ian very correctly identified personal communications as one of those rare Moments in American foreign policy where for one our democratic ambitions and our democratic values aligned with our national interests If we take a look at the five sanctioned state all of these are countries in which we have spent a great deal of resources investing in democratic capacity in civil society and So as a result of that this notion that that information technology Facilitates mobilization Facilitates political socialization it becomes very clear that an increase in this technology is therefore Good for the social fabric of the state as well as quite fortunately the foreign policy of the United States It is also Incidentally one of the often one of the rare things in which Diaspora civil society which have internal conflicts can agree on This is this is something that is important for everyone's being if you look so so well, I'll maybe get around to as result in 2010 after a substantial a substantial push by Iranian diaspora civil society You had the codification of sort of a two-track approach United States sanctions policy would Deem would would identify particular technologies that were deemed sensitive technologies This comes out of the comprehensive Iran sanctions and the vestment act and then on the other side you've had this this new classification Called personal communications technologies incidental online personal communications technologies So so what you had is this idea of restricting access to technologies that could be used by the state for repressive purposes as the same at the same time you start to promote a legal policy that makes available at least a limited subset of Technologies that could be used for communications and mobilization Since then you've had a sort of a growth and expansion of both of these classifications On the track of repressive technologies You had the the gravity executive order which allowed for not just sanctions inside of the country for human rights violations by technology but also you had the ability for now Extra-national second second-party sanctions of people Outside of those particular countries that were providing these you had the ability for the US government to disbar companies that were seen to facilitate The Iranian and Syrian states and providing these technologies But at the same time in all of these cases you had you had the notion that personal communications technologies should be protected Right after every statement of repressive technology you always had this line that personal communications over the internet should be a protected export and so as a result You you saw a very slow progression Specifically after 2010 only in Iran of the interpretive Guidances and licensing policies that would make these Technologies more available and so you had a 2012 interpretive guidance a Statement of licensing policy that would say that any license applications for personal communications would be deemed favorably And then ultimately general license D And I think I think I'll end it at that Yeah, I think I'll end it at that Thanks, Brad Thanks, and thanks for inviting me today. I am the Not I'm the guy who's not the expert on internet freedom or technology Spent exemplified by the fact that I needed to come here early today to because I couldn't get my computer to work And shop some work before the panel So I don't bring the sort of internet expertise internet freedom expertise or particularly around but As Danielle mentioned two parts of my Background sort of bring me bring me to this panel instead of make me interested in the topic first I served for a little over three years as an attorney in the office of the chief counsel for foreign assets control Which is the group of lawyers that? advise OFAC and My portfolio at the time included Sudan Liberia and a range of other primarily sanctions programs related to various African Countries and conflicts, but I also worked a little bit on terrorism and Burma and a few other programs and so can bring to the to the discussion some of the considerations that the agency needs to keep in mind when You know, I sat through a number of discussions in my time there where everybody around the table agrees on What the right? Outcome would be but it's very difficult to actually make it happen and when you are trying to Work in areas where you That are ubiquitous in general as as columnist explaining But you want to sort of pick and choose at some level how? how those technologies how those services how those transactions are going to be Who they're going to be used by when it's okay, and when it's not okay It makes the lawyers for the agency very nervous the OFAC is generally Given a fairly high level of deference by courts But it still operates under it's still an administrative agency that operates under a standard where it can't take actions that are deemed to be arbitrary and capricious it needs to take actions that are that are generally consistent or can be consistent across Across its different sanctions programs, even if the authorities differ and is always looking for consistency and that's why the the paper is Provides an interesting discussion point because in times there are sanctions where you want things to be handled differently OFAC wants the flexibility to be able to do things that address a particular national emergency at the same time Balancing that against the counterweight of how to ensure that Sanctions are being administered fairly and reasonably and consistently across all of the agencies activities One other you know of my experiences there that may come up as we talk about the private sector I worked on the Liberia sanctions and while I was there the UN removed much of the sanctions that had applied to Liberia particularly with respect to timber and diamonds and the remaining sanctions program was a quite limited list of people and and You know the hope was that the removal of those sanctions would certainly spur levels of investment in Liberia and as the sanctions were removed And time went on that wasn't happening and there was this question of what role should OFAC play In sort of telling people what the sanctions didn't cover right and telling people what was okay and sort of helping to move Investment into Liberia by saying look Liberia is no longer subject to you know the kinds of sanctions that were in place before And that prompts very I think important discussions about what OFAC's role is versus perhaps the State Department's role or other agencies roles in Not just administering sanctions, but sort of but then helping to deal with Situations post sanctions and helping to participate in whether it's reconstruction or investment or post-conflict investment or in this case You're talking about trying to get companies to do What OFAC is saying it's okay for them to do but you know there's always a line there that that is dangerous for OFAC to walk in terms of Advocating for companies to take steps that may it may say are okay, but you know it needs to preserve some level of neutrality about In my current role I work extensively with companies trying to understand trade sanctions, which You know even having worked in OFAC is often difficult for me to do Even today and companies I think face, you know, obviously the the risk the public reputation risk the financial risk OFAC's penalties are can be substantial The risks that companies face in trying to evaluate when It's okay to even get near to something that's Covered by sanctions let alone something that might actually fall within the scope of a general license Is is a very often very high-level conversation at a company and requires a Substantial expense for a company in terms of its own compliance programs ensuring that it has the right things in place And has talked to the to the right outside Experts and the last thing I'll say is My job in between those two was to work at the State Department on conflict diamonds and conflict minerals And in particular the conflict minerals discussion In the wake of legislation passed in 2010 As part of the Dodd-Frank financial reform bill there was a provision that requires all companies Reporting on stock exchanges to report on certain levels of undue diligence. They're undertaking with certain minerals It's a very complicated complicated rule a very expensive Undertaking and complicated process and the conversation now in that space is how do we get companies to? Responsibly engage in Congo and Central Africa We've set up this provision that requires them to understand what's in their supply chain And we want them to take seriously not causing harm in Central Africa, but we don't want them to leave Central Africa We want them to invest and there's this very difficult balance between companies Sort of walling themselves off from a difficult situation in this in that situation would be sourcing minerals from outside of Africa entirely Versus getting involved in getting engaged and perhaps taking on both Reputational and perhaps even compliance risks and I think the experience from that also Think weighs into this discussion of how companies evaluate when they should be involved in a difficult situation Versus when they should pull back in and leave it to someone else Yeah, good morning everybody My name is Anwar the fallah. I'm a computer scientist and Educator I'm interested in you know educating our kids in Sudan Having them trained and become ready for the knowledge economy for the 21st century I Studied I graduated from Egypt in 2002. I was wondering why we don't have Microsoft in Sudan Until I realized that there is a US sanctions That's the first time for me to be aware of you know the US sanctions and Some colleagues of mine couldn't get you know that the Microsoft and Cisco certification because they were Sudanese and I Was wondering about you know the notion of the sanctions and if you know the registrations and the regulators Are aware of you know the impact of these sanctions on ordinary people or citizens of Sudan and the sanctions country So I would like to engage you in in my story By just you know if you can raise off your mobile phone if you have one. Oh That's great Yeah, thank you so much You cannot do you know much with this phone in Sudan you can just you know say hi Goodbye and text message Nothing else and I bet if you have a mobile phone, then you have a credit card That you can make transactions online where you can buy you can sell and whatever we don't have that in Sudan You know it's it's really bad to the extent that you cannot download, you know Google Chrome from Sudan based on your location the geographical location so it's I obtained my PhD from South Korea and When I came back Sudan I started you know teaching at the universities and it was so frustrating to me to teach the students in The class something that they cannot practice Outside they they don't have access to you know the Most of you know that the free and open source software that's available to everybody else And they are not legal to to have a training courses and Get certified. It's very important for the you know the IT and computer science students to have this kind of Certificate to pursue their career access to knowledge is a big issue in Sudan I started TX cartoon back in 2011 and we had organized couple of events until we get the shutdown of the event by the government last May So access to knowledge is something that our government our repressive government doesn't like People started to protest after you know the the cut of the subsidiary of the oil and gas in in cartoon back in September and we had the internet shut down for the whole country and that was was was not justified by Anything else rather than you know having people don't have access to voice to send their voice outside So we have a kind of double pressure from repressive repressive government inside Sudan and limited access to knowledge and To education and to access from outside Sudan because of the UN sanctions So I'm really happy to be part of this panel and thanks to the New America Foundation for Disinputation, I'm really happy to be here and be part of the conversation I'm so happy, you know that I'm representing a wide range of people who don't have access who don't have a chance to you know to to To express what's going on inside Sudan. So yeah, thank you Thank you all for those very interesting introductions I'd like to start by talking a little bit about Iran and actually about some of some of the things that I think Brad and his introduction mentioned this idea that You you have a concept or something where everybody sitting around the table agrees about the outcome that that Something should be made available that these tools might be important But how do you get the question is how you get there and how what's the strategy for a policy? How do you create a policy that works and how do you actually, you know implement it and then get companies to implement it? so with that in mind, I'd like to talk a little bit first about Iran and so as we talked about was we mentioned in May the government issued general license D And that makes it legal for the first time for Since the sanctions have been in place for American companies to export not only software and services that are free and publicly available but also hardware and Products that that you actually have to pay for so this is everything from free antivirus software to cell phones and laptops The question is, you know, this is one of a series of steps. It's been taken since 2009 so how did we how did we get to this point and How what was the sort of gradual evolution and I'm hoping that Colin can talk a little bit about Sort of setting the stage in some of the context he mentioned some of it in his introduction And maybe if Ian can jump in as well With some of the the foreign policy perspective here and kind of the the question of Promoting internet freedom and promoting these policies How you actually what you what it actually looks like in practice and how we went from, you know The early off the first authorization and the statements of licensing policy and guidance to general license D Well, I think I think we covered some of the progression in the opening statements. So Rather to focus on one specific thing the reality is of most of these states is that control of information is fundamental to Political repression if you look at the statements and the request made by a very large portion of the civil society groups the substantial thing is is we need more than anything access to these platforms if you So let's start to take a piecemeal approach to looking at how states control these networks And I think the most substantial and meaningful one that still applies today is you have end user and host Computer security if you're an Iran You for one cannot buy a legitimate copy of your operating system. So you are most likely Buying something or using something that you bought for a dollar called the king's pack that has the photoshop and and and Microsoft Windows and Microsoft Word and to you know, it's it's the You know 13th version it might even be called the 2015 version when you bought it, but it is Incredibly dubiously sourced it will more often than not not receive updates And so structurally from the beginning your end host is Compromisable so based off of that for one like I said you can't update your software Because you've pirated your software, but let's say you would maintain a legitimate version Because you're in that country when your update service goes to try to connect to the end vendor The end vendor will block you so all of a sudden your adobe reader is a three-year-old version That happened to be the version that was out when the CD that you bought was installed and is now vulnerable to a Significant number of very easy to obtain exploits so based off of that you have a a a Vulnerable operating system with vulnerable software What is the state going to do? What is a politically repressive state going to do? They are going to malware everyone in civil society because it has no cost Malware towards one person is the same cost as malware towards everyone. You have their email address and so in every one of these states you've had a Specific targeted and broad sweeping campaigns to violate the information security of people inside of the country and outside of the country You have the cyber jihadists in Sudan you have the Iranian cyber army. You have the Syrian electronic army. These are state-sponsored actors that are using the disconnect between Technological security and the user as a way to start to round up political dissidents And so if you look the requests of the these the civil society in these companies or countries is more often than not Not specific technologies that are advanced not access to you know satellite internet rarely that But just the fundamental equality on the internet that everyone else appreciates and So I think that if you just take those what that one thing that one aspect That's what's generalizable and those are specific and direct causal relationships on top of that You have a significant number of ancillary second-party dependencies the internet is not one vendor one person everyone is dependent on on structural platforms structural mechanisms and so for example Go Daddy and and Google App Engine are amongst the most most popularly used web services companies They block access to everyone originating from a sanctioned state Most of their customers don't know this and so you have Things like high-profile academic critical sources of information about what's going on in these countries that are blocked Not because of the the governments that oppose them But actually because of their companies the companies they hosted with just a random choice But they don't know this and and this is the the importance of this cannot be understated because you have things like the econ Academy which is is blocked significant educational platforms that are not only important to access to knowledge but in some cases in which states significantly repress Access to educational systems based off of religious sexual or ethnic minority status It is the only access to to knowledge These are the tools in which civil society democratization religious groups need vitally and More and and it's a lot less sophisticated from satellite The problem for for a lot of these groups is is the difference between OFAC and state and commerce is Is an abstraction all they see is is that the United States? They they don't even understand the difference between a company a corporate decision Which is often more conservative than the letter of the law they don't understand the difference between that corporate decision and And the decision of the United States and so not only is this a strategic problem in our in our significantly Expansive and progressive internet freedom funding efforts, but it's also a public diplomacy problem Yeah, no, and I think look I mean and getting back to so all this is Not a mystery. I mean, I think that the colon can speak to this with a level of of knowledge and familiarity that few people have Anywhere even within the among the people who are trying to solve These problems, but I think you know getting to your question of The the question is Why did we get what we got? Why didn't we get more? Why Iran first? and what can we do to To take advantage of what has already happened to sort of let wedge the door open a little bit further and and on that I mean, I think Colin's in going back to your first comments. I think and Brad said this as well there is a general agreement that that a Free flow of information in these societies is in our benefit not just because we believe in freedom of Expression Association assembly online, but also that a safer internet a Safe internet where information can flow is in the interests of democratic reformers And the groups that we want to be supporting within repressive countries So that there's there's an agreement on Why we got it in Iran and not in other places or why there seems to have been at least recently more pushing Iran than in other places is really in some ways a Combination of more mundane bureaucratic Functions rather than any sort of substantive Difference, you know, it was a combination of having a very well staffed Program, there are a lot of people who work on Iran So there are a number of smart talented bright people who are working on that program a Real push to change the status quo and a desire to see the status quo being changed and that push being really kind of Crystallized around events like President making a speech on the ruse or elections coming up and a desire to see what can we do and that sort of bureaucratic Treeshaking in advance of those events to see what can be done and a situation that is kind of intractable that it's hard There's a lot of resources trying to make things better But not a lot of options available to those bureaucrats who are the people who are working within government To do that and so this sort of rises to the top in a way that it might not in another country where for Syria in Syria For instance where there are a lot of other things that people who the limited number of people who are working in that country are focusing their attention on Or other countries where there might not be the same level of staff resources really think about it And so when you go through the process and so that's is one side of it and then in going through the process of trying to Wrangle all of the parts of government that need to be involved in changing sanctions and export control policy in there are a lot of moving parts for one country there certainly was an interest in seeing some of the the Policies that we were crafting be more general and apply it to more places than Iran, but there was also the the strategic interests and getting it through quickly and Involving a lot of other countries in the discussion explicitly Would have slowed down the frankly would have slowed down the process on a number of these things And we thought it was I think there were decisions that were made that you know This is important for this moment in this country. Let's get that out now, and then we can follow up later on That that is a foothold around which we can broaden at a later point, and so I think in the well absolutely The the problems are real and need to be addressed and and it is Yeah, I think there is a recognition of that it's a matter of how do we you know take advantage of Working the levers in the right way to make it happen I mean just a couple quick I guess Thoughts from the you know sort of looking at this as a almost as a spectator In terms of why we got where we got I mean I think just a couple things to keep in mind I mean technology is probably you know the Hardest thing for for an agency to regulate because of the way it moves and because of its its quick evolution You know OFAC Especially at the licensing and policy level I mean you they're generalists right there people who are dealing with if you're an Iran licensing officer You're handling this and you're handling Food and you're handling you know and people bring you know dealing with their personal Personal transactions a whole range of things on a daily basis other export control agencies have Some of them anyway have sort of technical experts on particular You know kinds of munitions or kinds of products if a vote like a vote back as any industry expertise It's the financial sector because banks are really at the The forefront of implementing OFAC sanctions. So if there is any real industry expertise, it's financial It's not I mean I didn't even understand half of what Colin said and you know In terms of how does the internet? FX work for an agency to do that and then And then and then regulate it is very challenging and and I think you know when you look at what OFAC did over those course of Years, it's it's exactly about ensuring that they're not going too far too soon That they understand what they're doing and sort of taking a let everything that's free go out first see how that works Take a licensing policy and courage You know, it's not that exports What you know encouraging people to come in for licensing and allowing it on a specific basis and then rolling it out on a general basis That's a that's a sort of careful bureaucratic and maybe frustrating from the outside, but from from the inside an approach that ensures that they're They can understand what it is They're doing in the first place and then as they're doing it make sure that it's handled Properly, I mean OFAC, you know it evolves slowly the definition for information and information material still includes microfiche and microfilm and Without you know with no offense to librarians There aren't a lot of people that are looking at that and I think it's hard for information to be really wrestled with in a way That can be done Properly and I think Ian's point in terms of you know the bureaucratic muscle directed It's at Iran is is certainly undeniable. I mean it when I was working on Sudan in 2006 7 The height of the Darfur activism era and plant the rollout of plan B by the Bush administration I mean we often sort of said to ourselves It's difficult to get attention against Iran and against terrorism and against other really important sanctions programs And if anything over the last several years the focus on Iran has only Increased so I think it is It's not surprising at all that Iran would be the first place this would roll out in I think in terms of people understanding Internally what what Anwar referenced in terms of the situation in Sudan? It's it's difficult to get the right level of attention and the right level of understanding to figure out how these policies can can translate across so Great So I think one of the Really I think one of the keys that both Brad and And Ian have brought up is the the challenge of the technical definitions the the actual language itself and so One of the things you know talking a little bit specifically about General license the general license D I'd be curious for for For you guys to give some thoughts about Kind of what goes into coming up with those definitions and some of the Advocacy some of the conversations that you have to have to figure out What's the policy that you're that you're striving for and and how you can craft craft something that is both You know that that sort of meets all of these goals and as we lay them out that it sounds very ambitious It has to be something that you can get through the bureaucratic process. It has to be something that Is accurate and to the point in a way that companies feel that they that they can That their products actually meet those definitions and that therefore they're covered From a legal perspective and it also has to be something that is is flexible so that it doesn't change so that we're not You know talking about microfiche And and you know obviously if the technology is obsolete that maybe is one thing or again no offense the librarians But also if it's as things change, so I would would love to hear a little bit more about the the particular question of Actually crafting that language so that that first general license, but actually more specifically general license D Yeah, I guess one thing you know Being a lot being embedded in the belly of the beast of the bureaucratic process gave me both an incredible amount of frustration with the bureaucratic process and also a level of appreciation that I would never have had otherwise if I had been given the The the the power to just write the policy and I could write it on my own I'm sure it would have been awful, right? I think that there is a bureaucratic process for a reason that there are a lot of different interests that are involved and people who have very specific pieces of information about what are some of the Unintended consequences of some of the things that I might be interested in pursuing with it or there might be central to what the policy goals are that I'm Defending, you know, how is this going to affect other other interests and other people who are involved as well and part of that bureaucratic process is Getting to what is the right definition? There might be things that that are really important from a human rights and democracies standpoint, but have really bad unintended consequences from a actually supporting people that we wouldn't want to be supporting or from a You know Security standpoint some other way and so that is why that that process exists and and well it can be very frustrating at times I mean, I think that it certainly adds adds benefit One of things Part of this that I want to unpack this is something that Brad made a reference to is that it's even when everybody agrees That there should be some there are technologies that are not available today or not Explicitly permissible today that we want to permit. There are a number of vehicles They're available to do that and choosing the right vehicle really matters and so and I only got a Opportunity to skim the paper, but I know that the paper talks a bit about exemptions versus Licensing in general terms. I don't know if it also gets into the question of Do you issue a general license or do you issue a statement of favorable licensing policy? Which is another decision There might be tools that you want to be available in the country But you also want there are a number of reasons why you might still want to have some sort of licensing process For instance, you just want to know what is going in you would it would be useful information to know if a lot of really bad and Secure information technology was going into Iran or be useful information to know You know who who within the country has the ability to we we want cell phone networks to exist and to be maintained But it would be really useful to know who has the ability to set up and maintain a use a cell phone network within the country And who does not and so there are these decisions that need to be made about the the consequences of requiring a more burdensome process of companies Versus the the consequences of or the versus the benefits of having a different set of having more information or different other reasons We might have a different set of of tactics apart from so that's that's that's sort of the first set of questions And then what falls under it is a constantly moving list as well where? different people with different sets of technical knowledge or industry knowledge or knowledge about the How these tools are being used or how they could potentially be used or all part of that discussion of well How do we and and people who have an expertise in being able to define it in a way that companies are? Companies lawyers or the specialized lawyers that they bring in to talk to their lawyers can figure out Whether this applies to the tools that they're developing already, so I mean I don't know if that Gets it what you are looking for. I mean the answer you're looking for but it certainly does to accept I'd love to give Brad a moment and then I will get back to Colin I think if he's interested but grab right a moment to talk a little bit about that that difference between the authorization and the Exemption and then and some of the kind of the actual nuances of the licensing that impact the policies that we see sure so These terms are often kind of bandied about at the same time because at some level they have the same result which means which is If you are a company you can do Whatever it is you want to do without needing to go to OFAC and get a piece of paper that says it's okay for you To do that but the differences are important there is a There's something called the Berman amendment which was which was enacted Thanks to congressman Berman That exempts and sort of carves out from sanctions authorities the ability to regulate information and infer or informational materials So it and it also carves out for example travel. It's sort of a Directed at First Amendment type protections for all essentially that applies to all sanctions programs at this stage except for Cuba And so the travel part doesn't apply to Cuba the information does but essentially it means that OFAC can't regulate So you're sort of its territory where no where there can't be any Penalties there's no licensing OFAC doesn't have the authority to tell you it's okay to send a book to Cuba or to Iran Because it doesn't have jurisdiction over that that transaction That can be at some level can sound liberating that OFAC doesn't have authority But it it's from a company compliance perspective often difficult because you don't have anything saying it's okay You have only the interpretations and the sort of compliance program you can develop that You are internally comforting yourself that that transaction you're undertaking is okay And you're hoping that if you ever got asked by OFAC that why did you do that you can demonstrate? Hey, that was exempt. You don't have authority there, but that can be a difficult process a general license or an authorization or a You know a general license is something like general license D which OFAC issues and applies to every US person a Specific license is obviously one where you write in and they send you a license that says you can do What it you what it is you asked for? A general license is means that OFAC has jurisdiction Which means if you say you're using general license D But you don't fall within the terms of it OFAC can come back and say you and potentially pursue your penalties because you're using that license improperly just like if you had gotten a It's as if every person and you know open up their mail one day and had a license from OFAC that said you can send informational material you can send You can undertake transactions to allow you to engage in you know fee-based Skype with Iran But if you do it wrong then potentially you're you're facing violations, so again, it's In some ways it's better for a company to have that general license because there's at least something telling them what's in and what's out But again, you're still needing to maintain a compliance program that Should something asked should a bank stop a financial transaction you can then demonstrate Hey, this is covered by the general license a specific license You know that sort of follows licensing policy is you're going to write to OFAC and you're going to essentially wait for OFAC to decide whether or not your application fits within that scope of licensing Or not and you're likely to get a fair number of restrictions or conditions on how you use that license All of these things as it says as as you can understand are difficult from an from an agency perspective I mean many of the things Ian just described and and again the things that the kinds of issues call in got at You know to develop definitions and develop terms of the sort of what it is we're trying to What are we trying to regulate and what are we trying to allow at a kind of Conceptual level and then who are we trying to regulate it against right? I mean export controls That might be administered by the commerce department and the state department are Maybe primarily directed at the what you want your your concern about what it is that's being exported And kind of what risk that represents to the u.s. Government to allow it to go to a foreign person Sanctions are all about the who they're all about sort of who the person is at the other end And marrying up the kind of what it is we want to regulate with the who it is We want to allow To engage in a certain transaction or or prohibit from a certain transaction You know that's a narrow strip on a Venn diagram And it can be a difficult one to craft in any way that That has that as you mentioned daniel you want that to be flexible If it's going to take a year to figure it out you want it to have shelf life of more than a week before Um before either the what or the who change and if you think of a situation like syria Um, and I'm not a syria expert, but just understanding what I read in the news Um, if you would try to craft a sort of who it is we're trying to to allow to engage in certain activities in say 2011 in terms of the opposition and and the and the effort to overthrow to Protest the Assad regime. That's probably a very different who then exists in 2013 and figuring out how to maintain that in a way that again ensures that OFAC is is is uh Carrying out its activities consistently and reasonably and in a way that is an arbitrary is is a is a tough balance to uh to get to So I think that uh my role in this is to play the the foil to to treasury and state to a certain extent so Out of that I want to really respect the respect the position of treasury by sort of giving a little context because I understand I understand that treasury is basically a an organization with a fixed set of resources against an expanding set of responsibilities Treasury is responsible for some of the most broad sweeping Uh economic sanctions programs in the history of the united states It is responsible for constructing a program which denies any sort of commerce And so as civil society we are asking them to punch very narrow holes In a very very strict sanctions regime. That's incredibly difficult and And especially against you know increasing mandates due to congressional sanctions pressure that if you go if you if you mess up You're going to get dragged out to the hill probably I imagine that Uh essentially treasury is in a position of of determining what the joint plan of action is for the uh the iran nuclear agreement And so all of these requests that I'm making I understand and we we need to understand and respect the fact that those are occurring at the same time However, a lot of these requests are not are not taxes or requests for resources They're they're iterative processes in prioritizations Everything that every sort of licensing process every form of clearance is a tax on companies Which want to do good in countries where they can't necessarily even make a profit And so the more that we touch things and we want to evaluate things and we want to hold things up Just to make sure the more that it creates delays Even under a specific and favorable license License regime you see delays on applications that go from anywhere from five months to a year This is under favorable technology and often under the most non-controversial highly demanded services and so Now this is mind you I assume that the majority of resources are not going in treasury to licensing but probably enforcement And I think that we need to respect that and I think that actually More than civil society congress needs to respect that and maybe just as much as we're talking about Treasury doing the right thing to civil society and the publics of these countries We should be talking about how congress needs to do the right thing for treasury But also bind their hand a little bit and make them Have faster clearance times Uh However Taking a piecemeal approach taxes everyone including treasury and so having Uh incongruent sets of laws between countries means that all of a sudden you've increased substantially Compliance because you either have to deal with all sanctioned countries alike in which you're enforcing the lowest bar of regulation or you have to Uh evaluate every single licensing regime and imagine at the rate in which uh Uh Your average export compliance lawyer charges. Uh, how costly that is um Lastly, uh, what I want to say is is that in part this is solved by having an iterative Process that has more public attention because as civil society what we get is essentially a licensing policy Or a general license that drops out of nowhere and as best as we can do is we can throw as much information as possible In order to hopefully have some of it get in if if if There is a need for technical Expertise if there's a need for understanding the situational environment. This is exactly why civil society exists But instead you've had an opaque process for the most part In which in which there hasn't been External deliberation. There hasn't been external input. And so if these resources exist in the world We just have to have a more transparent Deliberative process in order to get to that place civil society iranian civil society is just as Concerned as the wrong about the wrong technology getting into iran as they are the right technology We're all on the same page in this regard And towards that we have to have a discussion about it Yeah, I guess I was going to push back a little bit on the process being entirely opaque I mean, I do think that It maybe has been selective and and certainly I know that that On the state side of state that there was a lot of consultation with Individually with groups that might have information about what would be what kind of technologies were being denied and what would be important when the The statement of licensing policy and Interpretive guidance rolled out. There was a big meeting There were a number of open meetings with with civil members of civil society and companies There were closed meetings And individual meetings There are probably five or six members of the state department who are in this audience right now and are participating in in These sorts of meetings so I think in some ways my view Was that At the time that a lot with with very rare exceptions with a few exceptional people There are very few people within civil society that were really prepared to talk about this in a way With this sort of depth that was necessary to really be helpful at the time. So well, it wasn't A an open process. I mean, honestly, there there was even a there There were documents that That had a a comment period that was involved as well and there were some there were some feedback to that is But but I you know, so I think you know, could it have been more open? Probably it could have but I but I do think that it was As open as many policies tend policymaking tends to be when you when you're working within a crunch time window I mean, I can see the frustration from the outside that you just never You know, you hear about this a year in advance And then it seems like there's no movement no movement in a movement and all of a sudden something drops I mean, that's just sort of the the frustrations of of how At the ebbs of flows of of these sorts of things go but I think that More organization on our side, which is again a good reason for us to be having a paper like this meetings like this will put us in a better position to To be able to practically influence those policies as as the opportunities come up Thank you guys I want to sort of segue a little bit and continue this conversation But but talk a little bit specifically also not just about what has happened for Iran, but about Sudan And you know, we've been talking about this from a foreign policy perspective And one of the things that that ian mentioned and that we observed is that you know, sometimes one one factor that can influence Policy change is also what's happening on the ground And so um, I'd love I'd like an anwar talked a little bit about this in his opening remarks about What's going on in Sudan right now and the impact of sanctions? I'd like if you could unpack that a little bit more in terms of talking about The nonviolent protest movement the role of you know, these kinds of tools and sort of the the negative impact of sanctions And we can talk then a little bit about What What a what a good policy solution for Sudan might look like what some of the challenges are And how that might work. So if you could sort of start us off Yeah, um, I guess that the available communication tools for the Sudanese activists online are little bit a few and when when you when you When you keep exploring That the available tools For the digital activists, you will find That the government cyber jihadist and the security agency has already, you know intervened For, you know, they their communication the secure communication the secure communication channels for for for the activist and we had, you know, a couple of activists were detained and torched and forced to open their facebook account the social social media account. So The tools are no more secure by any means and That's that's a trouble some for For, you know, that the whole Sudanese Protesters or the Sudanese Oppositions against the the government I think, you know that the The lack of training the proper training also for for the Sudanese youth Inside the universities inside the the public arena is also another factor to be added to the fact that You know the communication inside Sudan is not Is not secured for for people people losing their life because of their digital activism We have many security Officers inside the telecom companies the four major telecom companies in Sudan where they can They can observe and censor all the the digital transactions on daily basis. So so in In a nutshell I guess our our role as as a digital activist for, you know, people who are prove the government prove pro-democracy And against, you know, the terror act acts of the government We are in a weak position right now In Sudan and that has been happening for the past 14 years since Ninety 79 yeah 97 sorry Yeah, and I guess if We could have Like general license d like, you know at the what the iranian get That will make stuff much better than than what's going on during the the last protest in In Khartoum The internet shut down for the whole country And then we have a slow internet And then we have A catch for many digital activists up to now people are, you know subject to to, you know trials Going to court every day and then we have a media blackout. We have the you know shutdown of many newspapers Individend newspapers in Sudan so I guess that the the impact of the the sanctions Is is huge in this in this aspect because young people are using the social media to communicate and to To mobilize each other so One of the unintended consequences of the of the the sanctions is that the the software piracy now became a culture in Sudan So no no no the software piracy is is huge No one is expected to pay a penny for software even if it was made by Sudanese So, uh, I guess that as the time goes We'll have We'll have a you know a new entire new generation of young Sudanese who are not expected To be connected integrated to the world to the the knowledge economy As as it uh as it was supposed to be Also, we have a very high rise of you know viruses Circulating inside the networks of Sudan Um, I was looking at the report by the fcq lab in uh, Finland And I see Sudan is one of the the most active areas in viruses We are not source of viruses, but we are you know a big channel a very active area of of viruses so I hope we do we'll get the generalized d and we collaborate with the you know the people here In explaining and uh collaborating and and putting Maybe appropriate targeted sanctions against against the government not against the people in Sudan. Thank you I think we we don't have a ton of time left, but so I sort of I think to the point directly the question That you guys might be able to shed a little light on is is what does that take how possible How likely is it that we can or what would have to happen in order to see a policy change? For Sudan even you know If it's relying on the template of general license d and kind of moving that through government um Without without sort of being inside the the Sudan policy discussions. I think you know a lot of what You know what Ian and Colin described before in terms of what it took to get you know general license d And and its predecessors that sort of the evolution towards general license d in Sudan I mean, I think first there has to be agreement that this is the right That this is the right approach that this is the right that this is needed for For the people of Sudan for the for those who are protesting The Bashir regime and and sort of balancing how it you know what the appearances are and what else is happening in terms of the overall negotiations That are going on again I mean the the complexity of Sudan and the issues related to Sudan in terms of both its Relationship with the south and the border areas between north and south as well as Darfur and and other and the east and There are so many complexities to the the Sudanese issue it's sort of uh I think it would just take a fair amount of explaining about how Moving a general license or a statement of licensing policy through would still send the right signals to The Sudanese government would send the right people signals to the Sudanese people and and and then again balancing um Opening up these technologies to the Sudanese people without at the same time further empowering the Sudanese government can be a A difficult balance to make and and you know, I don't know the the details of sort of the The potential market or the potential risks that companies would face but again, even if you were to get the the government the u.s. Government to sort of issue these these I mean the the original general license in 2010 it did apply to Sudan it's sort of the statement of licensing policy and General license d for fee based products that that doesn't extend yet to Sudan Getting companies to extend their efforts in that direction may may be As difficult based on what the potential market is as well as what the potential Risks are for government that has been, you know involved in genocide and and and a range of of terrorists and other related activities to get the To get companies just to say that it's the right decision for them to to even take advantage of the general license Based on what the risks are Again, ensuring that they comply with the general license and then what the public reputation risks are I think would be a significant challenge I think it's because of the significant amount of attention around is at both bureaucratically but also In the public discourse, I think companies are Are likely more aware of the situation in and the risks involved in Iran than they would be of Sudan I'm making an assumption there. I don't know that to be the case But my my my sense would be that companies would face a lot more internal discussion about whether it's Taking advantage of a general license in the Sudan program would be would be appropriate. So I think it's It's a lot of education and a lot of outreach along the lines that that call and mention in terms of the role of civil society And the role of a activist on this here and in in cartoon Yeah, just Briefly, I mean, I do think that that having general license d out there for Iran does clear a lot of brush in some ways It it Answers a number of questions Some of those would need to be looked at You would you would state and treasury and others would want to look at those within the context of Sudan But having that as a template, I think is useful Two suggestions one would be certainly as as brad mentioned Treasury no fact feel a lot of pressure to be consistent And so appealing on the grounds of consistency that the principled arguments that were made around making these technologies available in Iran also apply in Sudan and and answering some of those questions about How what this looks like on the ground? What is available? What isn't but but appealing to that that desire to be consistent? I think is Will be important as you try to lateral these the general license d into other countries and then the second thing I would say is really engaging the The Sudan policy Community the diaspora community others who are engaged in the topic if people who are working on sedan don't hear this coming from The people that they talk to every day about sedan that they don't if these people aren't telling them But it's an important issue then they're they're Less likely to take it seriously Uh, so I think some education even within the the Sudan interest community The the civil society community specifically interested in sedan policy would be Important for getting the sort of traction that you're going to need to make a move So I'll give a simple philosophy and a simple rule And and then respect that the world does a little more nuance than that The simple philosophy is is that Personal communications is based off of the entirety of us law one of the areas in which Our democratic values align with our foreign policy interests bourbon from the outset sets us As one of the elements of of u.s. Sanction policies is access to information information materials is something that should not be regulated And so if we are going to start to take Foreign policy considerations vis-a-vis our relationships with with foreign governments into account It has to be a high bar for us to negotiate away those values Secondly a simple sort of rule or or a litmus test, which is repressive governments have pretty good access to anything that they want based off of the money the resources and the international connections that they have Sudan the the ruling elite of Sudan and syria By all indications have access to anything that they want because they either have the money or they have the relationships with Telecommunications companies that aren't particularly care Careful about human rights policies I think that our imaginations can sort of fill in the gaps of who that is Huawei Finally, oh, yeah zte Civil society understands its role in this and this is fundamental to the reason why we're here We understand that there are two barriers here a lot of them are not us policy they're the the decisions that are made in in council in companies That that we will never speak to Uh and have actually personally sometimes a very good reason for why they make the decisions that they do However, us policy is also a very good mechanism for uh For civil society to drive home the point that this is important This is legal and there are people out there to help you and so this is This is an area in which the united states has the ability to set the tone and to enable civil society to do A substantial amount of work that it is willing ready and able to do Great um, so we've got a few minutes left and I want to give the audience if anyone has any questions a chance to ask them um So If anyone has anything else they want to add if not, we can open it up that for appeal I think I saw a hand in the back there Thank you. Uh, this question is for mr. Anderson How much have you seen the state back hackers use vulnerabilities in old and outdated software to target dissidents? And do you see this extending to like external actors other countries, etc Is that an NSA reference the latter portion of it? Um, we we see it an incredibly Substantial portion of the time We see cases in which during the election in Iran The the Iranian cyber army was using vulnerabilities and outdated versions of readers in order in order to in order to gain access to Foreign-based journalists computers. They were sending files that would Proport to be statements of reformist figures and those would allow full access and on top of that This was effective We could see based off of some of the back-end reporting that we were able to gain access to for these these these efforts That there were times at this critical moment in electoral politics That that um, that these malicious entities these these state backed actors We're gay and we're compromising one person every hour And if you think about the role of of these sort of information leakages It's not just compromising one person. It's compromising entire networks. You're only as strong as your weakest link and so not only do we see significant recurrent and Broadly generalizable cases across all of these countries. We also see that they are effective and and on top of that It's clear that they're also growing I'm not sure I totally understand the external portion of the question I mean everyone's trying to hack everyone I mean states anonymous Yes, hi, um, um rob labor from afp you touched on this a little bit at the end About repressive governments having access to whatever they want, but um One of the things we we heard in in recent years when we talk about technology and sanctions Is that you know, we're we're trying to stop repressive governments from gaining access to certain sophisticated technology And even though you seem to be saying you're in agreement on a lot of things I sense maybe there's a little bit of disagreement here Are you trying to say that you want to just forget about sanctions All together in in this sector Or are you going to try to fine tune them in a way that seems pretty daunting given the given the technical savvy of the regulators Um, I think just briefly to address that It's the the idea here is not like a removal of technology sanctions in general But but a targeted approach and so um, I call and mentioned this at the beginning In his remarks when he talked about the sort of parallel track approach Uh towards the ron sanctions, which was um focusing on on availability for personal communications tools for the things that enable You know ordinary individuals and the population to communicate and access information but also actually a focus on Clearly defining the sensitive technologies the the censorship and surveillance equipment malware those Those things that that when they get in the hands of repressive governments are are even more dangerous and actually You know identifying how to enforce rules against those and clear penalties And so in a you know the parallel side of the the carve outs for personal communications tools in Our sanctions policy has been like the gravity executive order which applies to iran and syria Which talks about Those vary the technologies you can use to perpetuate human rights abuses and not Allowing american made technology to end up to be that technology. So for like the blue coats the uh, You know, uh, the california-based company that that provides surveillance equipment Um, not having that end up in the hands of sanctioned governments That doesn't mean that they may not be getting that technology elsewhere if they're not getting it from american companies And that's you know, I think a whole other issue, but um, it's not it's the idea or you know At least from our perspective is that um, you have to see both sides of the issue And so while you're talking about carve outs on one on one on the one hand, you're not we're not talking about you know A general removal of these uh of these sanctions It's terminology I mean one of the things one of the The predecessors to this project was actually that under under two of the sanctions bills there were mandates for The regulation of what was deemed sensitive technologies in the human rights context The same set of groups that are promoting exactly this issue of access to information also participated in a a substantial Response to a request for comment on defining what that what sensitive technologies are The this is this is something in which both Both sides are being dealt with What we're defining in terms of exemptions to sanctions are personal communications devices Their cell phones their laptops They're not higher end technology that are capable of substantially increasing the repressive capacity of the state And so in fact, I think that I think that we understand on top of that a mature policy towards export licensing Compliance has to understand regulating Specific forms of technology specific forms of uk use cases and end destinations at the same time as we have to have Broad authorizations or exemptions for technologies that that have so, you know, such a marginal chance of being used for illegitimate purposes Yeah, I mean it I hate to like have my final comment be a it's complicated compliment or comment But I mean that it is complicated and and there well There are a set of technologies that as Colin says that are easily defined as Oh, you know anti-virus software being available is better for the for for our interests than Even if the bad guys have it, it's better that anti-virus software be widely available to not So there's a set of technologies that are sort of Undeniably should be permissible and there's a set of technologies that are pretty undeniably Should not be permissible surreptitious Infection software Um, you know Tools to block circumvention tools things like that and that list exists as well as Colin mentioned Most technology is neither of those is is this dual use technology And in order for personal communication technology to work you need to have networks and networks are made of Routers and a lot of networking equipment that can be used for really really good things and can be used for really really bad Things and so that's where it begins to get really tricky Particularly for companies that are providing these sorts of tools to know, you know, if if the sanctions policy is You know, you can you can sell cookies, but you can't sell cakes Well, I make fig newtons. Which one of these categories do I fall into? I mean there is a and so you you can't in a lot of ways fault companies for saying well I'm just going to err on the side of caution and not make these tools available at all But and that's the the the very tricky Uh, set of issues that that we're negotiating and as Colin was saying where The field seems to be right now or we as a community seem to be is the you know, the best option is the know your New your user You know no not just what technology you're selling But who you're selling it to and how it's likely to be used and that that is an obligation that that were That we believe that that people who sell technology should have All right, we can we can do one last question and then I'm required to let you all leave the room. So Real quickly, um, what's the next steps for the paper after this? Okay, thanks, uh, Muhammad Najem from smx I have One thing to say before I ask my question I talked to a lot of people from Syria and other countries and They're many of them They know the the issue of the security from using these tools and these technologies But many of them as well prefer to be connected than being safe. So that's also another Another layer of discussion my question is I've been reading about this topic since 2009 2010 and Nothing has been really moving a lot on this issue Is there an advocacy campaign that's really moving and solving? Each topic and each obstacle so we can reach the The removing on the sanction on the technology for users So, um, uh, I guess what what I'll say is that um Next steps for us. So we're hoping and I think you know, we've we've had a really rich discussion here this morning And and gotten on a bunch of interesting topics in terms of What's left to be done? Which is that we've seen some really positive policy change There there's other things that need to go and and that it's clear that you know, that doesn't come from Just from civil society or just from the companies, but that this is actually a concerted effort. And so What what we're hoping to see is You know the groups, uh, the human rights groups and the activist groups that have really in a lot of ways led the charge in terms of making the case for why this is a problem in iran and in other countries to Continue to make that case and to to make it louder So that it so that it you know becomes more of an issue that has to be dealt with and that goes along with The educational aspects and you know working with with folks in government with other people to To really understand the issue and what the policy solution looks like That's a that's a hard thing where we want we would like to facilitate and help where we can This is you know from the the open technology institute But also really you know work with all these other incredible groups that are that are doing this And that are trying to you know figure out how How to really push the policy forward and so that you know in a couple years when we're having this conversation It's actually a different conversation because we've we've moved on from this. Did you Yeah, my name is uh tomorrow I'm the core of the report in many ways this event is also a call for action So if anyone in the audience and also listening to this event is interested in Helping to implement some of the recommendations that are outlined in the report. Please come see any of the panelists And we have some ideas, but are very open to other ideas as well So in many ways this event is also a call for action and hoping to get getting other people interested in this topic too And I will add it's it's an iterative process in terms of understanding it in terms of pushing the policy solution So we're looking forward to that um With that in mind we are over time So, um, I'd like to thank all of you in the audience once again for coming and of course to our panelists Ian Collin brad and anwar for taking the time to join us and for sharing their different experiences Um, if you have you know, we're welcome to if you have more questions to talk to us privately after or follow up And please have a wonderful day. Thank you