WEBVTT NOTE This file was generated by Descript <www.descript.com> 00:00:00.000 --> 00:00:02.639 Mike Huneke: The views expressed in this podcast are solely our own. 00:00:02.969 --> 00:00:05.520 This information is provided for your convenience. 00:00:05.729 --> 00:00:09.059 It does not constitute legal advice, nor does it create an 00:00:09.059 --> 00:00:10.589 attorney-client relationship. 00:00:10.589 --> 00:00:13.349 Prior results do not guarantee similar outcomes. 00:00:13.934 --> 00:00:15.584 This is attorney advertising. 00:00:15.584 --> 00:00:15.854 Enjoy. 00:00:30.638 --> 00:00:33.178 Hi, welcome again to Red Flags Rising. 00:00:33.178 --> 00:00:34.328 My name is Mike Huneke. 00:00:34.328 --> 00:00:39.198 I'm a partner at Morgan, Lewis, and Bockius LLP in their International Trade 00:00:39.198 --> 00:00:40.888 and National Security practice group. 00:00:40.888 --> 00:00:45.258 With me as always is my great friend, founder and chief solutions officer of Red 00:00:45.258 --> 00:00:48.678 Flags Rising Solutions LLC, Brent Carlson. 00:00:48.678 --> 00:00:51.978 Today is Thursday, September 17th, 2026, 00:00:54.088 --> 00:00:56.608 just after noon, US Eastern Time. 00:00:56.608 --> 00:00:57.578 Brent, great to see you. 00:00:57.598 --> 00:00:58.508 How are you doing today? 00:00:58.813 --> 00:00:59.533 Brent Carlson: Excellent, Mike. 00:00:59.533 --> 00:01:03.263 It is a joy and a privilege to be here today talking with you and sharing 00:01:03.263 --> 00:01:04.763 some thoughts with everyone out there. 00:01:04.813 --> 00:01:07.893 Mike Huneke: Well, Brent, you know, taking advantage of the name Solutions 00:01:07.923 --> 00:01:11.733 in your title and your company name, we wanted to update listeners about 00:01:11.793 --> 00:01:15.193 the website, redflagsrising.com. 00:01:15.193 --> 00:01:18.413 I understand you've done some solutions-related work recently 00:01:18.413 --> 00:01:19.403 on the back end of that. 00:01:19.403 --> 00:01:20.423 Why don't you tell us about that? 00:01:20.423 --> 00:01:21.073 Brent Carlson: Yeah, Mike. 00:01:21.143 --> 00:01:25.383 You know, it's a, it's a hard pill to swallow, but it's a good one to swallow 00:01:25.663 --> 00:01:29.523 when you realize that you've been doing something wrong for a very long time. 00:01:29.523 --> 00:01:32.239 And then when that happens, you gotta fix it. 00:01:32.240 --> 00:01:37.080 A year ago, I had set up this website for Red Flags Rising Solutions. 00:01:37.080 --> 00:01:38.810 It's redflagsrising.com. 00:01:38.860 --> 00:01:43.523 I put all our materials up there, our podcasts, the Fresh Look series for 00:01:43.553 --> 00:01:48.483 NYU Law School's program on corporate compliance and enforcement, our world 00:01:48.483 --> 00:01:54.733 ECR articles of the Glass Onion, and the new era of high probability enforcement. 00:01:54.736 --> 00:01:57.926 I thought it was great, and I would steer people toward it because I keep it as 00:01:57.926 --> 00:02:03.723 a repository of all this great content that's helpful and hands-on and practical. 00:02:03.723 --> 00:02:08.753 Well, turns out, on the back end on the website, I'd found out that I had 00:02:08.753 --> 00:02:12.483 to go through certain steps to make sure that it would be a trusted site, 00:02:12.483 --> 00:02:16.633 especially with big firms out there that have filtering for websites. 00:02:17.444 --> 00:02:20.942 Look at it's a small firm, new website tends to get filtered. 00:02:20.950 --> 00:02:24.570 I was aghast, and after I sort of picked my heart up off the floor, I went back 00:02:24.570 --> 00:02:28.710 and figured it out, and this is actually where a shout-out to incorporating AI 00:02:28.720 --> 00:02:31.730 tools into your work can be very helpful. 00:02:31.730 --> 00:02:38.750 Because between me and my AI chatbot friend, I was able to diagnose step 00:02:38.770 --> 00:02:41.360 by step what to do to go clear it up. 00:02:41.594 --> 00:02:46.980 That cleared up those technical logjams in the website piping. 00:02:47.160 --> 00:02:50.930 So for anyone out there who went to the website, and they got like, " This 00:02:50.950 --> 00:02:55.347 is a uncategorized website," or it had some sort of red flag on the 00:02:55.347 --> 00:02:57.417 red flags website, my apologies. 00:02:57.467 --> 00:02:58.697 It is now clear. 00:02:58.699 --> 00:03:02.167 One of those backend providers, they give a rating. 00:03:02.217 --> 00:03:04.737 Mine was moderate, and they updated it now into safe. 00:03:04.797 --> 00:03:06.567 So everything's all cool there. 00:03:06.710 --> 00:03:07.710 But go check it out. 00:03:07.710 --> 00:03:09.450 It's got great content on there. 00:03:09.480 --> 00:03:12.380 Like I said, we put our writings on there. 00:03:12.467 --> 00:03:16.217 I put the description of the Fraud Four Circle framework, you 00:03:16.217 --> 00:03:18.227 can see on the Insights page. 00:03:18.227 --> 00:03:22.359 These are very helpful tools to deal with the compliance challenges that 00:03:22.399 --> 00:03:25.589 everyone faces today, 'cause we're all looking for practical solutions. 00:03:25.713 --> 00:03:28.647 But anyway, it's kind of funny because it's like discovering when you've been 00:03:28.647 --> 00:03:30.027 doing something wrong for a long time. 00:03:30.027 --> 00:03:33.657 It's like that, whatever that, that s- classic several stages of grief. 00:03:33.657 --> 00:03:37.867 First is like denial, then shock, anger, and acceptance. 00:03:37.867 --> 00:03:39.244 And then, then you just jump right in. 00:03:39.414 --> 00:03:43.007 Basically, it took like a millisecond to go through all those stages, and then 00:03:43.007 --> 00:03:44.817 it's like just jump right in and fix it. 00:03:44.817 --> 00:03:46.047 But anyway, it's there. 00:03:46.047 --> 00:03:46.657 It's up. 00:03:46.821 --> 00:03:47.647 Please take a look. 00:03:47.647 --> 00:03:51.407 And again, my apologies for anyone out there who went to it and in 00:03:51.407 --> 00:03:54.807 their organization got it flagged as a potentially risky site. 00:03:54.955 --> 00:03:57.907 it's only risky if you don't look and incorporate the information in it. 00:03:58.121 --> 00:04:00.391 Mike Huneke: For everyone out there, I know a lot of us are looking 00:04:00.391 --> 00:04:02.381 for something to look at quickly. 00:04:02.381 --> 00:04:05.351 You've got five minutes before a meeting, and you're thinking, "Oh, 00:04:05.351 --> 00:04:09.081 no, what's the latest?" Or, "What is that solution again?" Or, "I heard 00:04:09.081 --> 00:04:12.551 that guy Brent talking over and over again about high-probability 00:04:12.551 --> 00:04:14.234 knowledge." It's all here. 00:04:14.264 --> 00:04:15.154 It's all free. 00:04:15.174 --> 00:04:19.844 It's all now very publicly available, despite whatever whitelisting your company 00:04:19.844 --> 00:04:21.901 or your service provider might be using. 00:04:22.071 --> 00:04:25.391 I've got it up on the share screen, so if anyone is watching us on 00:04:25.401 --> 00:04:29.857 YouTube, and yes, we are on YouTube, you can see the screen for yourself, 00:04:29.867 --> 00:04:30.857 and I'll walk through it here. 00:04:30.857 --> 00:04:35.314 But for those of you listening, it's redflagsrising.com. 00:04:35.314 --> 00:04:38.554 The homepage has some contact information for Brent. 00:04:38.554 --> 00:04:42.564 There are links to the podcast under the heading Podcast, including an 00:04:42.564 --> 00:04:47.384 embedded link to our RSS site, so you can scroll the episodes there. 00:04:47.384 --> 00:04:49.354 You can learn about the company. 00:04:49.521 --> 00:04:54.511 Under the Solutions tab, Brent explains the Fraud Four Circle Framework and 00:04:54.511 --> 00:04:58.621 talks about how that applies to risk assessments, due diligence, corporate 00:04:58.621 --> 00:05:02.251 investigations, commercial disputes, interim management monitoring, and I'd 00:05:02.271 --> 00:05:04.841 add to that M&A due diligence as well. 00:05:04.841 --> 00:05:08.011 We have a little bit about Brent as the founder, and then the Insights 00:05:08.011 --> 00:05:12.471 tab has articles, including several with World ECR and other things that 00:05:12.471 --> 00:05:14.551 might be difficult to find otherwise. 00:05:14.747 --> 00:05:20.004 Finally, at the end of the header row is a link to our Fresh Looks series 00:05:20.004 --> 00:05:24.644 with the NYU Law School's Program on Corporate Compliance and Enforcement. 00:05:24.807 --> 00:05:28.477 We're forever grateful to those guys for being a great platform for us 00:05:28.477 --> 00:05:32.787 to put really in one spot a soup to nuts view about what our vision 00:05:32.787 --> 00:05:37.257 means for identifying, assessing, and mitigating national security risk 00:05:37.287 --> 00:05:41.327 generally, and with an emphasis on export controls risk in particular. 00:05:41.337 --> 00:05:44.157 So highly encourage everyone to go there. 00:05:44.167 --> 00:05:47.287 We'll put several links in the show notes as usual. 00:05:47.464 --> 00:05:49.613 Brent, you know, it's just part of the journey, right? 00:05:49.843 --> 00:05:53.371 For anyone out there starting your own shop, your own law firm, your own 00:05:53.371 --> 00:05:57.487 consulting firm, reach out to Brent and benefit from his experience and lessons 00:05:57.517 --> 00:06:01.807 learned because, you know, if you look at some of these websites in a box services, 00:06:01.807 --> 00:06:05.797 they don't say, "Oh, yeah, you have to open the hood and kinda rewire the Google 00:06:05.797 --> 00:06:08.777 workspace that's running underneath." And until you do that, you're gonna 00:06:08.777 --> 00:06:13.387 be categorized as some kind of shady, miscellaneous, like, scam-based website. 00:06:13.389 --> 00:06:16.527 But you can fix that and actually fix it, it turns out, pretty quickly. 00:06:16.634 --> 00:06:17.254 Well done, Brent. 00:06:17.264 --> 00:06:19.221 And thanks as always for, you know, sharing. 00:06:19.414 --> 00:06:24.274 When we talk about people struggling together to manage these geopolitical 00:06:24.284 --> 00:06:27.054 changes that we're facing, sometimes the challenges are a little 00:06:27.054 --> 00:06:30.354 more, little more personal and a little more technical than that. 00:06:30.364 --> 00:06:32.434 So as always, thanks for sharing. 00:06:32.604 --> 00:06:35.034 Brent Carlson: It's part of the journey, like you said, Mike, and if we don't 00:06:35.034 --> 00:06:36.184 make mistakes, we're not learning. 00:06:36.351 --> 00:06:39.791 We learn even under situations where we assume everything's going right, where 00:06:39.791 --> 00:06:42.561 the conditions may have been fine before. 00:06:42.821 --> 00:06:46.111 Mike Huneke: Yeah, and actually the website discussion we just had is 00:06:46.111 --> 00:06:50.691 useful because a lot of what we will be referencing today is further explained 00:06:50.701 --> 00:06:55.681 in more detail with citations to authorities, citations to supporting 00:06:55.681 --> 00:06:57.564 documentation, on your website. 00:06:57.807 --> 00:07:01.857 But we thought it was a good time to come back to the knowledge standard. 00:07:01.857 --> 00:07:04.187 It's definitely a topic we have discussed. 00:07:04.387 --> 00:07:09.087 We keep coming back to this theme and the double-edged nature of this knowledge 00:07:09.107 --> 00:07:12.838 sword, which is that it makes it easier for the government to enforce because 00:07:12.838 --> 00:07:15.088 they don't have to prove actual knowledge. 00:07:15.088 --> 00:07:19.068 They can prove you had a reason to know or an awareness of high probability of 00:07:19.068 --> 00:07:23.020 a violation, and we'll talk about in which specific context that applies. 00:07:23.020 --> 00:07:28.370 But it also is the foundational basis for companies, for exporters, 00:07:28.380 --> 00:07:32.300 for people dealing with potential export controls exposure to make 00:07:32.330 --> 00:07:37.920 and defend risk-based decisions and risk-based judgments that then help 00:07:37.920 --> 00:07:42.540 them to rightsize, rightscope their compliance resources and time and effort 00:07:42.540 --> 00:07:42.790 that 00:07:42.800 --> 00:07:46.650 might allow for some actual sleep at night and some mental health. 00:07:46.650 --> 00:07:48.480 We see a ton of burnout in this space. 00:07:48.510 --> 00:07:51.080 No one has infinite, unlimited resources. 00:07:51.140 --> 00:07:55.630 These are tools that can help you at least feel comfortable that, even though 00:07:55.630 --> 00:07:59.350 you're making inherently subjective judgment calls about risk, you can 00:07:59.350 --> 00:08:03.800 defend to a skeptical regulator, sometimes maybe really skeptical, 00:08:03.800 --> 00:08:05.900 why and how you made those decisions. 00:08:06.096 --> 00:08:09.026 We've mentioned a few times, mistakes will be made. 00:08:09.026 --> 00:08:12.686 You're dealing with state actors, you're dealing with military procurement 00:08:12.686 --> 00:08:16.436 attempts, you're dealing with intelligence communities from other countries, all of 00:08:16.436 --> 00:08:21.556 whom consider many of these items that we talk about on our podcast to be the most 00:08:21.566 --> 00:08:26.606 important items in the national security race, in the geopolitical competition 00:08:26.606 --> 00:08:28.216 that's playing out in front of us today. 00:08:28.266 --> 00:08:30.376 Mistakes will be made, but this helps you defend it. 00:08:30.570 --> 00:08:33.470 So Brent, where do you wanna kick off this sort of, let's call it 00:08:33.470 --> 00:08:35.860 Knowledge 101 refresher course? 00:08:36.093 --> 00:08:37.243 Brent Carlson: Let's start at the beginning. 00:08:37.263 --> 00:08:39.703 Like you mentioned, Mike, we've been in a lot of discussions with a lot of different 00:08:39.703 --> 00:08:45.153 folks, and there's been a growing awareness of, I guess that's a pun, but 00:08:45.153 --> 00:08:47.283 anyway, a growing awareness of knowledge. 00:08:47.492 --> 00:08:49.330 But people still have a lot of questions around it. 00:08:49.340 --> 00:08:51.610 There's still some misunderstandings that swirl around it. 00:08:51.610 --> 00:08:55.280 It is much simpler than many people may have the impression that it may be. 00:08:55.513 --> 00:08:58.673 Sometimes in life when dealing with complex problems, we 00:08:58.673 --> 00:09:00.393 look for complex solutions. 00:09:00.393 --> 00:09:02.023 But actually it's really the opposite. 00:09:02.033 --> 00:09:06.193 What really works best in complex situations are simple solutions or 00:09:06.193 --> 00:09:09.533 simple and elegant solutions to get right to the core of the problem. 00:09:09.723 --> 00:09:13.220 In this world where we're at the geopolitical climate that we're 00:09:13.230 --> 00:09:14.710 in there's a clear trend line. 00:09:14.710 --> 00:09:15.800 Pressure is increasing. 00:09:15.910 --> 00:09:20.420 There's increasing interest and pressure growing in Congress, bipartisan 00:09:20.420 --> 00:09:24.483 in terms of what to do about these national security issues, export 00:09:24.483 --> 00:09:26.063 controls being an important one. 00:09:26.186 --> 00:09:27.976 People are looking around, where are solutions? 00:09:27.976 --> 00:09:31.506 There's a whole slew of bills that are going through Congress to address 00:09:31.506 --> 00:09:35.116 different pieces of export controls because there is the view out there that 00:09:35.136 --> 00:09:37.046 export controls haven't been effective. 00:09:37.196 --> 00:09:38.756 But I think that's changing. 00:09:38.866 --> 00:09:41.736 We've seen corporate enforcement cases that have changed that. 00:09:41.736 --> 00:09:45.166 From our own personal viewpoint, there'd be more on the way. 00:09:45.186 --> 00:09:47.706 You can see that through the news stories out there. 00:09:47.706 --> 00:09:48.666 There's media coverage. 00:09:48.666 --> 00:09:53.358 New York Times posted a couple stories recently that have caused a bit of a stir. 00:09:53.378 --> 00:09:56.225 It's important to look at what is driving all this, to to just go 00:09:56.225 --> 00:09:57.965 back and unpack what is knowledge. 00:09:58.125 --> 00:10:00.645 When people talk about export controls, a lot of times you hear, "Oh, it's 00:10:00.645 --> 00:10:04.405 complex." And it's like, yeah, any system, when you get in the weeds, if you're 00:10:04.405 --> 00:10:08.765 down in the back plumbing, it's gonna look like a rat's nest of complexity. 00:10:08.765 --> 00:10:12.295 But you go back, "Okay, what are the core issues there that are driving this?" 00:10:12.295 --> 00:10:15.328 So you don't get lost in the weeds, you don't get lost on technicalities. 00:10:15.505 --> 00:10:17.545 What are the real lines that are driving risk. 00:10:17.765 --> 00:10:20.055 You and I, we've been talking about this for a long time. 00:10:20.055 --> 00:10:23.415 It is the full definition of knowledge under the EAR. 00:10:23.615 --> 00:10:26.315 Why don't we start with a refresher on that, and then we can talk about 00:10:26.315 --> 00:10:29.585 some common misperceptions that we've come across in discussions 00:10:29.585 --> 00:10:30.945 and unpack those a little bit. 00:10:31.125 --> 00:10:31.885 Mike Huneke: Sounds great, Brent. 00:10:31.885 --> 00:10:36.525 One of the resources that we'll recommend people have at hand is our article about 00:10:36.525 --> 00:10:41.135 the Knowledge Glass Onion, sort of playing on the classic Beatles song, which itself 00:10:41.135 --> 00:10:45.385 is open to multiple interpretations, but with the idea that you, it looks layered 00:10:45.385 --> 00:10:49.195 and cloudy and complex when it's all together, but when you peel it back layer 00:10:49.195 --> 00:10:51.335 by layer, actually each layer is clear. 00:10:51.445 --> 00:10:52.995 That's the right way to think about this. 00:10:53.131 --> 00:10:56.651 There are three tiers to the knowledge definition under the US 00:10:56.681 --> 00:11:00.411 Export Administration Regulations going back to nineteen ninety-six. 00:11:00.411 --> 00:11:02.761 Positive knowledge, so you actually know. 00:11:02.925 --> 00:11:06.955 I like to sort of joke during training sessions or CLEs that someone writes 00:11:06.975 --> 00:11:09.455 Tehran on the shipping label on the box. 00:11:09.455 --> 00:11:11.335 Actual knowledge, you know where it's going. 00:11:11.335 --> 00:11:14.225 It also, though, includes two other things that are short of that. 00:11:14.225 --> 00:11:15.955 One of those is reason to know. 00:11:15.955 --> 00:11:19.435 People who are listening who are familiar with OFAC enforcement guidance 00:11:19.435 --> 00:11:21.255 are familiar with this standard. 00:11:21.488 --> 00:11:26.188 Think of it like it says Jebel Ali on the shipping label, but you have a purchase 00:11:26.188 --> 00:11:28.808 order with a mailing address of Tehran. 00:11:28.985 --> 00:11:32.425 Somewhere in your system, the word Tehran was floating around. 00:11:32.648 --> 00:11:36.688 The third tier of this is an awareness of a high probability. 00:11:36.901 --> 00:11:39.671 This is where people, I think, have the most trouble 00:11:39.691 --> 00:11:41.311 because it sounds complicated. 00:11:41.311 --> 00:11:44.051 You know, we talk about probabilities, possibilities. 00:11:44.218 --> 00:11:46.568 We've written about the distinction between the two. 00:11:46.788 --> 00:11:52.458 But awareness of a high probability is not some random set of words that were added 00:11:52.458 --> 00:11:54.508 to the regulations in nineteen ninety-six. 00:11:54.705 --> 00:11:58.795 They were very specifically borrowed from the US Foreign Corrupt Practices Act. 00:11:59.031 --> 00:12:01.899 We're fortunate enough, Brent, to have talked to a person who was there, who did 00:12:01.899 --> 00:12:03.955 that with that specific purpose in mind. 00:12:03.955 --> 00:12:08.755 And in turn, those amendments to the FCPA were specifically drawing this language 00:12:08.765 --> 00:12:11.275 from what's called the Model Penal Code. 00:12:11.451 --> 00:12:15.491 This was a multi-decade effort by law professors in the United States 00:12:15.521 --> 00:12:21.291 to impose some sort of uniformity across the criminal law in individual 00:12:21.291 --> 00:12:23.211 US states and at the federal level. 00:12:23.211 --> 00:12:26.621 Some states adopted this, but generally that effort failed completely, 00:12:26.621 --> 00:12:27.961 especially at the federal level. 00:12:27.961 --> 00:12:31.591 But in nineteen eighty-eight, some staffer on the Hill, and I would love 00:12:31.611 --> 00:12:35.157 to at some point figure out the real story behind this, at the conference 00:12:35.167 --> 00:12:39.157 committee between the Senate and the House debating the final text of the nineteen 00:12:39.207 --> 00:12:43.717 eighty-eight amendments to the FCPA, slid this in with a footnote to a prior 00:12:43.717 --> 00:12:45.427 failed effort to adopt this standard. 00:12:45.437 --> 00:12:49.251 But then it became the law for the FCPA, and off we were running twenty years later 00:12:49.251 --> 00:12:50.751 when there was actually then enforcement. 00:12:50.751 --> 00:12:54.511 But in nineteen ninety-six, BIS deliberately pulled this definition 00:12:54.521 --> 00:12:56.211 into the definition of knowledge. 00:12:56.521 --> 00:13:00.111 Now, they also give a little bit of guidance in the definition 00:13:00.111 --> 00:13:01.701 itself about what that means. 00:13:01.701 --> 00:13:06.411 Awareness is inferred from the conscious disregard of facts known to a person 00:13:06.411 --> 00:13:09.161 and from the willful avoidance of facts. 00:13:09.161 --> 00:13:13.021 So if you've dealt with any type of regulatory advisory, kinda 00:13:13.031 --> 00:13:16.811 white collar topic before, this is always floating out there. 00:13:16.821 --> 00:13:20.491 This is the door that slams shut on the loopholes. 00:13:20.491 --> 00:13:20.741 This 00:13:20.751 --> 00:13:23.721 is what gives the government the ability to say, "Well, if you think you're being 00:13:23.721 --> 00:13:28.171 cute by setting up offshore structures, and you're deliberately structuring 00:13:28.181 --> 00:13:32.941 things in a way to artificially limit your knowledge, you are on an 00:13:32.941 --> 00:13:34.441 awareness of a high probability." 00:13:34.441 --> 00:13:39.251 That's not just the stuff of law school professors or ivory tower legal advice. 00:13:39.401 --> 00:13:41.861 That's been litigated in the context of the Foreign Corrupt 00:13:41.861 --> 00:13:43.431 Practice Act and upheld. 00:13:43.551 --> 00:13:46.731 Jury instructions with those words have been upheld in 00:13:46.731 --> 00:13:48.871 contested US court proceedings. 00:13:48.881 --> 00:13:52.691 There's this whole world of law where it's been the driving factor 00:13:52.691 --> 00:13:54.141 for twenty years of enforcement. 00:13:54.161 --> 00:13:56.521 There's been public statements from officials about it. 00:13:56.521 --> 00:14:01.037 There's been guidance on it, and, frankly, a large body of legal 00:14:01.037 --> 00:14:02.827 analysis done on what that means. 00:14:03.054 --> 00:14:04.964 Brent Carlson: And actually in export controls enforcements, 00:14:04.994 --> 00:14:08.641 we've seen high probability enforcement cases on companies. 00:14:08.757 --> 00:14:13.137 Corporate enforcement that specifically cites that high probability standard, 00:14:13.137 --> 00:14:14.517 part of the full definition of knowledge. 00:14:14.517 --> 00:14:15.397 Mike Huneke: Yeah, absolutely, Brent. 00:14:15.417 --> 00:14:18.947 And that's another wrinkle to this that especially I think non-US 00:14:18.967 --> 00:14:21.167 companies are often surprised by. 00:14:21.167 --> 00:14:24.957 In the United States, an employee's knowledge can be imputed to the 00:14:24.957 --> 00:14:28.537 firm, and the knowledge of multiple employees can be aggregated. 00:14:28.537 --> 00:14:31.877 This is called the collective knowledge doctrine, and if you think about 00:14:31.877 --> 00:14:36.847 the ability of the US government to aggregate the facts known across 00:14:36.857 --> 00:14:41.167 several employees and attribute that aggregated collective knowledge to 00:14:41.167 --> 00:14:45.587 the corporation, that's obviously an extremely powerful tool in the enforcement 00:14:45.657 --> 00:14:48.017 toolbox and often surprises people. 00:14:48.017 --> 00:14:52.967 In the FCPA space, what happened is that over the past two decades of 00:14:52.977 --> 00:14:57.117 enforcement, there was sort of a detente or an understanding reached between 00:14:57.127 --> 00:15:00.087 industry and government in that context. 00:15:00.087 --> 00:15:04.947 Essentially, the understanding was, "Look, we expect you, industry, to undertake 00:15:04.997 --> 00:15:09.547 risk-based and bona fide efforts to identify red flags and where they are 00:15:09.557 --> 00:15:14.807 present, to be able to explain to us how you've mitigated them to somewhere 00:15:14.817 --> 00:15:18.777 below high probability that the bribe was being paid through a third party." 00:15:19.051 --> 00:15:23.037 There's a lot of discussion and parsing of some of the guidance from 00:15:23.037 --> 00:15:25.507 BIS in the export controls context. 00:15:25.507 --> 00:15:27.887 But really, there's fundamental operating rules. 00:15:28.093 --> 00:15:32.313 Absent red flags, there is no affirmative duty to inquire, right? 00:15:32.313 --> 00:15:35.460 But you can't self-blind to those red flags. 00:15:35.490 --> 00:15:39.233 And once those red flags appear, BIS considers there to be a duty 00:15:39.233 --> 00:15:41.083 to check those circumstances. 00:15:41.183 --> 00:15:44.433 How you do that, why you do that is a challenge. 00:15:44.677 --> 00:15:47.577 The real big challenge for any company involved in international 00:15:47.577 --> 00:15:49.637 trade, Brent, is where do we do that? 00:15:49.637 --> 00:15:52.937 And when we miss it somewhere else, how do we explain why 00:15:52.937 --> 00:15:54.487 we looked here but not there? 00:15:54.487 --> 00:15:58.507 And here is gonna be some very small percentage of global sales, right? 00:15:58.517 --> 00:16:01.067 Some very, very small percentage of global sales. 00:16:01.067 --> 00:16:05.677 But there are ways and methodologies to make and defend those essentially 00:16:05.687 --> 00:16:10.457 very severe triage decisions, and then explain to the government why, if you're 00:16:10.457 --> 00:16:14.267 ever challenged about this, what you were looking at in a more thorough 00:16:14.267 --> 00:16:17.907 way, let's say you're going beyond self-certifications, you're going beyond 00:16:17.917 --> 00:16:21.937 end-use certifications, why those were your greatest risks, including because 00:16:21.937 --> 00:16:25.827 of the national security harm that could happen if something went wrong there. 00:16:25.827 --> 00:16:27.667 Brent Carlson: One thing I'd like to just call out when we're 00:16:27.667 --> 00:16:30.947 talking about supplement number three to part seven thirty-two. 00:16:31.127 --> 00:16:34.567 What we've seen is a lot of people just cherry-pick that one 00:16:34.567 --> 00:16:35.857 statement right in the middle. 00:16:35.857 --> 00:16:39.707 It said, "Absent red flags, there's no affirmative duty to inquire, verify, or 00:16:39.737 --> 00:16:42.037 go beyond a customer's representations." 00:16:42.037 --> 00:16:46.327 But we gotta look right above that line and look right below that line in that 00:16:46.327 --> 00:16:49.167 supplement three to seven thirty-two. 00:16:49.167 --> 00:16:51.067 It is very, very clear. 00:16:51.067 --> 00:16:55.267 If you've got red flags, then you cannot take a customer's representations. 00:16:55.437 --> 00:16:59.017 You have to do your due diligence to address and mitigate them. 00:16:59.197 --> 00:17:00.977 That's where I think people get caught up a bit. 00:17:01.067 --> 00:17:02.707 It's probably a legacy view. 00:17:03.314 --> 00:17:05.734 BIS really wasn't enforcing this for decades. 00:17:05.744 --> 00:17:09.165 It was in the law since nineteen ninety-six, and it was only mid-twenty 00:17:09.165 --> 00:17:14.285 twenty-four when BIS revived it and started putting industry on notice, 00:17:14.285 --> 00:17:17.665 starting with the guidance that was in July twenty twenty-four. 00:17:17.665 --> 00:17:22.075 Then you saw the first high probability settlement case that came through. 00:17:22.075 --> 00:17:25.975 Then there was a notice to financial institutions reminding them of 00:17:25.975 --> 00:17:27.735 the full definition of knowledge. 00:17:27.898 --> 00:17:31.148 Then we see another big corporate enforcement case that's come 00:17:31.148 --> 00:17:32.928 through July of last year. 00:17:33.115 --> 00:17:34.675 Then some additional ones come through. 00:17:34.911 --> 00:17:38.341 So, it's the tip of the iceberg in terms of what's coming on the enforcement side. 00:17:38.391 --> 00:17:43.401 That said, for companies, you can protect yourself by taking this seriously and then 00:17:43.401 --> 00:17:47.835 having your own process to incorporate the full definition of knowledge in the 00:17:47.835 --> 00:17:51.985 compliance program, and have a methodology for sussing out those red flags, like 00:17:52.025 --> 00:17:54.075 adopting the Fraud Four Circle Framework. 00:17:54.225 --> 00:17:57.005 Because this is not like we're back in high school, and it's like, "Well, 00:17:57.005 --> 00:17:59.975 where's your, where's your homework?" "Well, it's zero." Well, a zero is 00:17:59.985 --> 00:18:01.925 zero, so you can't just have zero. 00:18:01.925 --> 00:18:05.115 You gotta have something, and it's gotta be justifiable. 00:18:05.115 --> 00:18:07.825 It's gotta be defendable, especially in this world, because we're 00:18:07.825 --> 00:18:09.335 talking national security here. 00:18:09.335 --> 00:18:11.345 This is something where people's lives are at stake. 00:18:11.631 --> 00:18:13.681 Mike Huneke: So Brent, we've pulled together a list, and I 00:18:13.691 --> 00:18:17.231 think it'll be illustrative to walk through it with our listeners of 00:18:17.231 --> 00:18:18.801 really common misunderstandings. 00:18:18.801 --> 00:18:21.935 I'm gonna actually add one at the beginning because one of the 00:18:21.935 --> 00:18:24.725 fundamental things we hear is like, "Well, all these national security 00:18:24.725 --> 00:18:26.615 laws, aren't they strict liability? 00:18:26.615 --> 00:18:29.195 And don't I have to classify the item? 00:18:29.195 --> 00:18:32.955 You know, isn't it really just about the technical characteristics and capabilities 00:18:32.955 --> 00:18:36.965 of the technology or the item that we're talking about?" It's absolutely correct 00:18:36.965 --> 00:18:41.631 that a lot of the US export administration regulations, and I think, we counted 00:18:41.631 --> 00:18:44.761 on the last episode, there's something like fourteen hundred pages of them as 00:18:44.761 --> 00:18:46.601 of the beginning of this calendar year. 00:18:46.601 --> 00:18:50.401 It's correct that, you know, those include a lot of strict liability offenses. 00:18:50.401 --> 00:18:54.221 So, like shipping to somebody on the entity list, it's a catch-all 00:18:54.231 --> 00:18:55.601 provision, but its strict liability. 00:18:55.601 --> 00:18:57.811 BIS doesn't have to prove you were aware of it. 00:18:57.821 --> 00:19:00.701 They don't have to prove that you intended in some way to 00:19:00.701 --> 00:19:02.291 violate the export controls. 00:19:02.291 --> 00:19:05.531 They can just hold up the item, find it in the possession of someone on the 00:19:05.531 --> 00:19:07.466 entity list, and fine you based on that. 00:19:07.480 --> 00:19:10.970 If you're talking about the license requirements that turn on item 00:19:10.970 --> 00:19:14.200 classification, that's very technical and very straightforward, right? 00:19:14.230 --> 00:19:17.820 And we hear people say all the time, "Well, if the speed limit's sixty-five, 00:19:17.850 --> 00:19:20.490 I can go sixty-four no problem," right? 00:19:20.686 --> 00:19:23.930 Well, yes, for those types of controls. 00:19:23.930 --> 00:19:27.771 If you think about export controls as having two main buckets, a 00:19:27.771 --> 00:19:32.051 huge bucket is the item-based classifications or the Export Controls 00:19:32.051 --> 00:19:34.401 Classification Number or ECCN. 00:19:34.741 --> 00:19:39.531 People analyze with excruciating precision, does something fall into 00:19:39.531 --> 00:19:45.481 one of the ECCN definitions, or is it maybe EAR99, which means it's not 00:19:45.481 --> 00:19:48.161 subject to a specific ECCN control. 00:19:48.357 --> 00:19:48.657 Brent Carlson: That's 00:19:48.667 --> 00:19:49.887 Mike Huneke: only half of it. 00:19:49.887 --> 00:19:53.514 The other major bucket of US export controls are catch-all 00:19:53.514 --> 00:19:57.304 provisions, many, many, many of which turn on your knowledge. 00:19:57.304 --> 00:20:01.034 And look, I think the government thought it was doing exporters a favor because, 00:20:01.044 --> 00:20:05.224 again, if you take, for example, the military intelligence end use or end user 00:20:05.224 --> 00:20:09.254 catch-all, those people are probably gonna be really good at disguising who they are. 00:20:09.304 --> 00:20:13.434 But if you have some awareness of a high probability or a reason to 00:20:13.434 --> 00:20:16.474 know that that's what's happening, including through, say, entity 00:20:16.474 --> 00:20:20.114 shifting, and we'll talk about some topologies later in the episode here, 00:20:20.114 --> 00:20:23.024 then that's something the government has every right to go after you for. 00:20:23.117 --> 00:20:27.367 The other place these things come in are in the enforcement enhancing and 00:20:27.367 --> 00:20:31.457 anti-circumvention provisions of the EAR, so maybe it's a smaller third 00:20:31.457 --> 00:20:34.707 bucket to the big two ones I mentioned, but these are very, very important, 00:20:34.707 --> 00:20:39.777 again, because these use the knowledge standard to close misperceived loopholes. 00:20:40.014 --> 00:20:42.664 The main one that we've talked about a lot is General Prohibition 00:20:42.664 --> 00:20:44.994 Ten, and we'll link to it in the notes, but go back and read it. 00:20:44.994 --> 00:20:49.124 It covers essentially any activity while having knowledge of not only 00:20:49.124 --> 00:20:52.474 a present violation, but a past violation or a future violation. 00:20:52.956 --> 00:20:56.258 When you think about what that means, it sounds like the use of knowledge 00:20:56.268 --> 00:20:58.278 as a qualifier there is limiting. 00:20:58.278 --> 00:21:01.538 And if knowledge meant actual knowledge, it would be very limiting, right? 00:21:01.678 --> 00:21:04.788 But knowledge and General Prohibition Ten, just like every other part of 00:21:04.818 --> 00:21:08.418 the Export Administration Regulations, is defined to include not only actual 00:21:08.418 --> 00:21:12.178 knowledge, but reason to know or an awareness of a high probability. 00:21:12.428 --> 00:21:16.075 You want to be able to show to the government if you have a problem or if 00:21:16.075 --> 00:21:20.215 there's an outreach visit or, worse, an investigation later, why and how your 00:21:20.235 --> 00:21:24.835 export controls compliance program is identifying potential high-probability 00:21:24.835 --> 00:21:28.141 awareness of past, present, or future violations and what you're 00:21:28.151 --> 00:21:30.491 doing to mitigate the risk of those. 00:21:30.731 --> 00:21:32.891 High probability does not mean zero risk. 00:21:32.891 --> 00:21:36.368 Probably doesn't even mean fifty percent risk, even though I'd caution anyone from 00:21:36.368 --> 00:21:38.368 trying to put a precise number on that. 00:21:38.408 --> 00:21:39.678 This is not science. 00:21:39.678 --> 00:21:40.678 This is not math. 00:21:40.678 --> 00:21:41.895 But that's a key area. 00:21:42.065 --> 00:21:47.624 Brent, we've referred often to the inchoate provisions, I-N-C-H-O-A-T-E. 00:21:47.814 --> 00:21:50.234 What that means is not quite fully formed. 00:21:50.457 --> 00:21:54.319 Anyone who's practiced in any area of white-collar criminal defense knows these 00:21:54.319 --> 00:21:59.089 by heart: aiding, abetting, conspiracy, obstruction, misrepresentations. 00:21:59.089 --> 00:22:02.276 Interestingly, in the EAR, there's a separate one specifically 00:22:02.276 --> 00:22:03.739 for acting with knowledge. 00:22:03.929 --> 00:22:07.342 All of these follow acting in violation of the regs, which itself 00:22:07.342 --> 00:22:10.142 is strict liability, and then there's acting with knowledge. 00:22:10.392 --> 00:22:14.272 Now, you might read that and think, " with knowledge of a violation," so there has to 00:22:14.282 --> 00:22:18.656 have been a violation that has occurred, and you might think you could go to BIS 00:22:18.656 --> 00:22:23.026 and argue in defense of yourself that if you didn't have actual knowledge of a 00:22:23.076 --> 00:22:27.516 predicate violation, that BIS could not bring this acting with knowledge charge 00:22:27.516 --> 00:22:30.756 against you, which if anyone wants to look it up, it's in seven sixty-four 00:22:30.756 --> 00:22:35.685 point two ( e) There's nothing in that provision that says BIS has to prove or 00:22:35.685 --> 00:22:38.275 establish some predicate act or violation. 00:22:38.275 --> 00:22:41.105 Frankly, they don't even have to prove that there was a prior export. 00:22:41.105 --> 00:22:44.745 Again, if we compare this to the Foreign Corrupt Practices Act, under 00:22:44.745 --> 00:22:49.535 the FCPA, if you were out bribed by somebody else, if the third party that 00:22:49.535 --> 00:22:53.135 you thought was going to forward your payment on as a bribe just stole your 00:22:53.135 --> 00:22:57.645 money and kept it, because of the way high probability works as a modifier, 00:22:57.645 --> 00:23:02.395 acting with high probability awareness is itself an independent violation. 00:23:02.395 --> 00:23:07.758 So look, BIS could always choose to exercise prosecutorial discretion or 00:23:07.758 --> 00:23:12.058 choose in the context of a negotiated resolution to dial back a bit how 00:23:12.058 --> 00:23:13.808 strictly it wants to interpret that. 00:23:14.088 --> 00:23:17.288 Remember, we've talked about weather vane compliance as a real 00:23:17.288 --> 00:23:18.728 thing people have to worry about. 00:23:18.728 --> 00:23:21.768 Weather vanes sit on top of barns, and the weather vane's always the 00:23:21.768 --> 00:23:24.578 same, but it turns a bit depending on how the wind is blowing. 00:23:24.578 --> 00:23:27.708 You know, depending on how the geopolitical winds, national political 00:23:27.708 --> 00:23:30.738 winds are blowing, depending on how the congressional winds are blowing. 00:23:30.738 --> 00:23:34.478 There's a lot of flexibility in how these terms can be interpreted and applied. 00:23:34.698 --> 00:23:39.328 But it would be a mistake to think that BIS is limited in using that provision 00:23:39.328 --> 00:23:42.378 unless they can show some kind of predicate act, and I think if you go back 00:23:42.378 --> 00:23:45.908 and look at even very recent enforcement actions through settlement, but recent 00:23:45.908 --> 00:23:49.602 enforcement actions, they've not considered themselves to be so limited. 00:23:49.798 --> 00:23:52.662 Brent, with that maybe a bit long, kickoff of the common 00:23:52.662 --> 00:23:55.932 misunderstandings, what is another misunderstanding we want to address? 00:23:56.112 --> 00:23:57.042 Brent Carlson: It was more than a kickoff. 00:23:57.052 --> 00:24:00.845 That was a great explanation jumping into the key misunderstanding. 00:24:00.905 --> 00:24:01.905 But it's nothing new. 00:24:01.905 --> 00:24:03.705 It's not a new rule out of BIS. 00:24:03.725 --> 00:24:07.775 It's been the letter of the law for three decades and has been successfully 00:24:07.775 --> 00:24:11.645 applied and survived challenge in court in other contexts, specifically the 00:24:11.645 --> 00:24:13.275 Foreign Corrupt Practices Act context. 00:24:13.542 --> 00:24:19.419 Yeah, it took until mid 2024 for BIS to go back and dust it off. 00:24:19.419 --> 00:24:21.029 This is not a novel legal theory. 00:24:21.029 --> 00:24:22.009 It's not a new rule. 00:24:22.202 --> 00:24:23.962 It's not a novel concept at all. 00:24:23.962 --> 00:24:28.182 Maybe we talk a little bit about where programs can go wrong about the screening. 00:24:28.182 --> 00:24:29.182 Screening is diligence. 00:24:29.182 --> 00:24:32.892 Screening is just a first step and actually some of the riskiest 00:24:32.912 --> 00:24:36.172 counterparties that a company may have are with entities that 00:24:36.172 --> 00:24:37.482 are not on the entity list. 00:24:37.705 --> 00:24:39.545 This is where the issues of red flags come in. 00:24:39.739 --> 00:24:43.669 I would point people to the original NYU program on corporate compliance 00:24:43.669 --> 00:24:47.999 and enforcement blog article that kicked off our Fresh Look series, When 00:24:48.009 --> 00:24:52.039 Loopholes Create Liability Pitfalls: A Fresh Look at Export Controls. 00:24:52.315 --> 00:24:55.985 In that I describe a scenario which is exactly the same pattern 00:24:55.995 --> 00:25:00.185 which was in that major corporate enforcement case from July of 2025, 00:25:00.185 --> 00:25:02.175 where a customer goes on entity list. 00:25:02.205 --> 00:25:02.935 Then what happens? 00:25:02.935 --> 00:25:05.445 Business gets shifted to a subsidiary or affiliate. 00:25:05.445 --> 00:25:08.535 That, the timing of that, and the issues around it, look at again from 00:25:08.535 --> 00:25:11.455 the perspective of the Fraud Four-Circle Framework, those are red flags. 00:25:11.505 --> 00:25:12.655 That's just not a freebie. 00:25:12.775 --> 00:25:15.082 There's been misunderstandings where, " Oh, there's a company 00:25:15.082 --> 00:25:18.152 that's on the entity list, but their subsidiaries and affiliates are not 00:25:18.192 --> 00:25:21.122 on the entity list, so it's fine to go ship to a subsidiary or affiliate." 00:25:21.122 --> 00:25:22.312 Not necessarily. 00:25:22.312 --> 00:25:27.402 If in the context and timing of when that business shifted to that affiliate or 00:25:27.422 --> 00:25:31.119 subsidiary, that's a red flag on its own that needs to be addressed and mitigated. 00:25:31.119 --> 00:25:32.619 It can't just go alone. 00:25:32.619 --> 00:25:33.429 Any thoughts on that? 00:25:33.429 --> 00:25:33.659 Mike Huneke: Yeah. 00:25:33.659 --> 00:25:37.769 Well, I think what you were just talking about, Brent, is a nice segue to another 00:25:37.789 --> 00:25:41.975 misperception that we wanted to highlight to get people thinking about how and 00:25:41.975 --> 00:25:45.781 where they may need or want to enhance their current mindset around these topics. 00:25:45.781 --> 00:25:49.061 And that concept is legally distinct being a safe harbor. 00:25:49.338 --> 00:25:53.881 Legally distinct is very important in terms of a specific catch-all provision 00:25:53.881 --> 00:25:56.061 that revolves around the entity list. 00:25:56.271 --> 00:26:00.285 In the context of the entity list, yes, BIS has said that the entity list 00:26:00.285 --> 00:26:04.495 does not automatically apply to an entity that is legally distinct from 00:26:04.495 --> 00:26:06.325 the entity that is placed on the list. 00:26:06.325 --> 00:26:09.605 Now, that does not change the anti-diversion rules. 00:26:09.615 --> 00:26:12.065 It doesn't change the acting with awareness rules. 00:26:12.065 --> 00:26:17.745 And I think people sometimes expand that aspect of the Entity List catchall, 00:26:17.745 --> 00:26:21.165 and apply it to other provisions that really aren't bound by it. 00:26:21.328 --> 00:26:25.075 I'd also caution that if and when the affiliates rule comes back, the 00:26:25.075 --> 00:26:29.075 affiliates rule expressly disavowed the legally distinct standard 00:26:29.075 --> 00:26:32.805 as applying in that context and required people to look at ownership 00:26:32.805 --> 00:26:36.848 and, where they couldn't ascertain ownership fully, looking at control. 00:26:36.848 --> 00:26:39.788 Now, the other thing I'll say on this is that, Brent, you know, one thing 00:26:39.788 --> 00:26:43.288 you and I have been talking about a lot is this idea that geopolitically, 00:26:43.288 --> 00:26:44.018 we are very quickly moving 00:26:46.248 --> 00:26:51.788 away from a world where national security was furthered by free trade 00:26:51.788 --> 00:26:55.552 and transparency to such extent that I think we were maybe willing 00:26:55.552 --> 00:26:59.862 to accept things that likely weren't true, but in the name of free trade 00:26:59.917 --> 00:27:01.387 were willing to accept as true. 00:27:01.387 --> 00:27:05.627 You know, certifications, representations, warranties are 00:27:05.627 --> 00:27:10.014 meaningful where they are enforceable by free and fair courts and where 00:27:10.024 --> 00:27:13.274 parties know that if they lie on those 00:27:13.274 --> 00:27:14.294 certifications 00:27:14.334 --> 00:27:18.024 or in making those reps and warranties, that there will be a consequence to them. 00:27:18.034 --> 00:27:21.964 But if those parties are in jurisdictions where there aren't those conditions or 00:27:21.964 --> 00:27:26.384 that frankly just because of current trends might be actually becoming more 00:27:26.384 --> 00:27:30.874 closed rather than open, your ability to enforce those is very limited. 00:27:30.884 --> 00:27:34.494 You add on top of that the challenge of countermeasures in certain countries that 00:27:34.494 --> 00:27:38.284 further increase the risk of even relying on those or trying to enforce them. 00:27:38.485 --> 00:27:44.300 We are incredibly fortunate to be in a system with free markets and free courts. 00:27:44.417 --> 00:27:47.987 That has allowed tremendous economic growth over however many 00:27:47.987 --> 00:27:51.307 hundred years you wanna track that, the development of that to. 00:27:51.477 --> 00:27:51.717 But. 00:27:51.737 --> 00:27:56.157 not every system, not every country, not every tradition values 00:27:56.157 --> 00:27:58.027 those things or upholds them. 00:27:58.027 --> 00:28:02.049 And where you don't have them, once we decide as the United States or 00:28:02.122 --> 00:28:05.147 increasingly, frankly, as China or as Europe, that we don't necessarily 00:28:05.147 --> 00:28:08.767 trust certifications from people from other countries, you're kind of left 00:28:08.767 --> 00:28:12.537 with other data points that you have to look to beyond the certification. 00:28:12.540 --> 00:28:13.647 You can't look at everything. 00:28:13.647 --> 00:28:16.537 As long as there's some form of global trade, which we're confident 00:28:16.537 --> 00:28:19.547 and hopeful there will remain to be, if you're a company of any 00:28:19.547 --> 00:28:23.420 size, you will kill the business if you try to investigate everything. 00:28:23.420 --> 00:28:25.490 And the government's not expecting you to do that. 00:28:25.650 --> 00:28:29.760 But you do need to show a shift in view, a shift in perspective, and be able to 00:28:29.760 --> 00:28:34.133 demonstrate how, where, and with what tools you're mitigating those risks. 00:28:34.303 --> 00:28:36.313 Brent Carlson: I have an interesting anecdote on this one. 00:28:36.313 --> 00:28:39.880 And so this goes back to my days, when I was at graduate school at Yale, and I 00:28:39.880 --> 00:28:41.650 had a history professor, Jonathan Spence. 00:28:41.840 --> 00:28:45.250 He mentioned that it was documented in the Qing Dynasty that some companies 00:28:45.250 --> 00:28:48.447 would have three different sets of books: one that they would present to 00:28:48.447 --> 00:28:51.897 the regulators, one they kind of have like a first-level internal, and then 00:28:51.897 --> 00:28:53.537 the last one a true internal internal. 00:28:53.537 --> 00:28:57.057 The point in that goes back to the issue of relying on certifications. 00:28:57.384 --> 00:29:00.085 In the China business days when I was there, I got a common 00:29:00.085 --> 00:29:02.935 saying , "Zhao ge ren gai ge zhang," so find somebody and chop a chop. 00:29:02.935 --> 00:29:05.615 So it's like making a certification is easy. 00:29:05.615 --> 00:29:08.055 That's why you have to look at things holistically, look 00:29:08.115 --> 00:29:09.995 at the mosaic of data points. 00:29:09.995 --> 00:29:14.585 There you can find clear patterns and get to answers and solutions that can protect 00:29:14.585 --> 00:29:15.985 yourself while still doing the business. 00:29:15.985 --> 00:29:17.285 But you're going in eyes wide open. 00:29:17.285 --> 00:29:19.846 You're not gonna do anything that's gonna shoot yourself in the foot. 00:29:19.936 --> 00:29:23.579 I think that's just an interesting anecdote from the front lines of 00:29:23.599 --> 00:29:25.989 business, especially in the PRC. 00:29:25.989 --> 00:29:29.219 One thing I just wanted to touch upon too before we move ahead is just talking about 00:29:29.219 --> 00:29:31.199 the affiliates rule just a little bit. 00:29:31.259 --> 00:29:34.252 It came on hard and then kind of left with a whimper. 00:29:34.429 --> 00:29:37.679 It was paused due to trade negotiations between the US and China. 00:29:37.679 --> 00:29:41.839 One thing I think is really interesting is that the one thing that survives 00:29:41.949 --> 00:29:46.389 are standards, principles, these rules, these basic first principle 00:29:46.399 --> 00:29:48.629 elements that are part of the law. 00:29:48.629 --> 00:29:52.189 What may come and go is like individual rules like this, but one of the things I 00:29:52.189 --> 00:29:55.709 just wanted to point out on the affiliates rule is that the knowledge standard, 00:29:55.709 --> 00:29:59.129 or we some- you know, also refer to as the high probability standard, really 00:29:59.129 --> 00:30:02.289 makes the affiliates rule unnecessary if you're looking at it from a 00:30:02.289 --> 00:30:04.059 compliance and enforcement perspective. 00:30:04.059 --> 00:30:07.639 Because number one, it takes that decision-making process or that due 00:30:07.639 --> 00:30:11.069 diligence process out of the hands of companies for affiliates with 00:30:11.069 --> 00:30:12.729 fifty percent or more ownership. 00:30:12.729 --> 00:30:16.499 But to go back to the anecdote I just talked about from when I was in 00:30:16.499 --> 00:30:20.209 graduate school, it is no problem, and it takes a millisecond for a 00:30:20.209 --> 00:30:25.433 company to re-register a subsidiary or affiliate below that threshold. 00:30:25.433 --> 00:30:28.633 So that threshold is an artificial number, and from a practical reality, 00:30:28.634 --> 00:30:29.983 it's really not that effective. 00:30:29.983 --> 00:30:32.963 And this is where it goes back to first principles why the knowledge standard 00:30:32.963 --> 00:30:34.443 is something that will carry the day. 00:30:34.650 --> 00:30:35.710 Look, people are smart. 00:30:35.710 --> 00:30:36.830 People in government are smart. 00:30:36.860 --> 00:30:38.130 People in industry are smart. 00:30:38.130 --> 00:30:41.910 Smart people will recognize this, will see it, and find true effective solutions, 00:30:41.910 --> 00:30:43.390 which already happened to be there. 00:30:43.690 --> 00:30:45.210 Mike Huneke: Brent, that's all really well said. 00:30:45.457 --> 00:30:49.837 I really liked how you characterized what do we think the future looks like with 00:30:49.837 --> 00:30:51.867 the knowledge standard carrying the day. 00:30:51.867 --> 00:30:53.877 Everything else is deeply unsatisfying. 00:30:53.877 --> 00:30:57.697 It's unsatisfying to Congress, I suspect it's unsatisfying to BIS, 00:30:57.697 --> 00:31:01.727 because if you focus on corporate formalities and paper, you're always 00:31:01.747 --> 00:31:02.997 gonna be behind the eight ball. 00:31:02.997 --> 00:31:04.827 You're always gonna be playing Whac-A-Mole. 00:31:04.970 --> 00:31:08.410 Are we really shocked that the Russian or Chinese intelligence 00:31:08.410 --> 00:31:11.976 community folks already have the structures in place to do this. 00:31:11.976 --> 00:31:15.396 It brings to mind an important distinction that needs to be made 00:31:15.396 --> 00:31:17.916 between sanctions and export controls. 00:31:18.102 --> 00:31:20.492 This is really the root of the problem with the affiliates rule. 00:31:20.804 --> 00:31:24.409 A BIS official's in a confirmation hearing, and a senator whose vote he 00:31:24.409 --> 00:31:28.449 needs to be confirmed says, "Hey, wouldn't it be great if we just adopted the same 00:31:28.509 --> 00:31:32.715 OFAC 50% rule in the export controls?" I don't begrudge this person at all, 00:31:32.715 --> 00:31:35.915 but they say, "Of course, Senator, that's a great idea." I'd say exactly 00:31:35.915 --> 00:31:37.585 the same thing in the same context. 00:31:37.848 --> 00:31:41.958 But think about the different purposes and objectives of those rules. 00:31:41.958 --> 00:31:47.028 In the context of sanctions, our national security objective is to specifically 00:31:47.028 --> 00:31:51.838 put pain, economic pain, on an individual or a company that we designate. 00:31:51.838 --> 00:31:55.658 The whole purpose is for them to have to restructure their lives, get rid 00:31:55.658 --> 00:31:59.898 of assets, and be limited in their ability to access the financial system. 00:31:59.918 --> 00:32:02.018 It's very individualized. 00:32:02.028 --> 00:32:05.158 The harm is the person, the legal person sometimes if 00:32:05.158 --> 00:32:06.408 we're talking about an entity. 00:32:06.408 --> 00:32:10.398 When you're talking about export controls, the item or technology kills people, and 00:32:10.398 --> 00:32:12.018 we don't want someone else to have it. 00:32:12.018 --> 00:32:17.608 Do we really think that a 30%-owned subsidiary of an entity is somehow less 00:32:17.618 --> 00:32:22.968 likely to reroute that item to their parent entity than a 51%-owned subsidiary? 00:32:22.968 --> 00:32:28.100 And like you said, at this point, it was September of 2025 that it was enacted. 00:32:28.100 --> 00:32:31.400 If there's a company out there in the world that was concerned about being 00:32:31.410 --> 00:32:35.160 captured by the affiliates rule in September of 2025, and they haven't 00:32:35.180 --> 00:32:39.080 solved that problem from a corporate structure and ownership and shareholding 00:32:39.080 --> 00:32:42.520 and otherwise from a corporate formalities perspective, then I would be really 00:32:42.520 --> 00:32:46.180 shocked and would not consider them to be any serious national security 00:32:46.180 --> 00:32:47.910 threat if they hadn't moved accordingly. 00:32:47.910 --> 00:32:51.550 So I worry that the affiliates rule is more for show than effect. 00:32:51.820 --> 00:32:54.990 I say that without any disparagement, like I mentioned before. 00:32:54.990 --> 00:32:59.210 But what people need to understand is the affiliates rule imposes tremendous 00:32:59.210 --> 00:33:01.460 burdens on in-house compliance teams. 00:33:01.730 --> 00:33:04.710 What they also need to understand is what does it look like on the 00:33:04.710 --> 00:33:08.270 ground, in the trenches, in-house when this rule is in effect. 00:33:08.270 --> 00:33:11.540 You're getting your due diligence reports, because you're trying to do a good job, 00:33:11.550 --> 00:33:14.940 you're getting independent verification where you can, and you're likely looking 00:33:15.160 --> 00:33:17.030 at three if not four data points. 00:33:17.040 --> 00:33:20.350 You're looking at one or two due diligence vendors reports. 00:33:20.350 --> 00:33:25.250 You're looking at whatever your in-house teams might be able to find in terms of 00:33:25.250 --> 00:33:27.260 corporate histories or registrations. 00:33:27.260 --> 00:33:29.420 And you're looking at information from your counterparty. 00:33:29.596 --> 00:33:31.406 All of those data points are gonna be different. 00:33:31.556 --> 00:33:35.353 How on earth do you reconcile those in a way to get comfortable 00:33:35.363 --> 00:33:38.753 shipping a national security controlled item to the counterparty? 00:33:38.939 --> 00:33:40.519 You can't investigate everything. 00:33:40.639 --> 00:33:43.789 You end up having to investigate your due diligence vendors. 00:33:43.789 --> 00:33:45.399 Well, what's the date of your data? 00:33:45.399 --> 00:33:46.429 Why did you think that? 00:33:46.429 --> 00:33:48.019 Can I see the underlying report? 00:33:48.169 --> 00:33:52.043 You're ending up doing a full enhanced due diligence that, if there were real risks 00:33:52.053 --> 00:33:53.843 that you identified, you would do anyway. 00:33:53.893 --> 00:33:56.326 You're forced into this horrible shell game. 00:33:56.376 --> 00:33:58.966 By the time you reach a conclusion, it's probably already changed. 00:33:59.129 --> 00:33:59.449 All right. 00:33:59.449 --> 00:34:03.459 So Brent, with that, let's talk about some hypotheticals, because this is 00:34:03.459 --> 00:34:06.969 an area where even if there are some straightforward or elegant solutions, 00:34:06.969 --> 00:34:08.879 it's helpful to have them illustrated. 00:34:08.879 --> 00:34:10.639 What are some hypotheticals that come to your mind? 00:34:10.976 --> 00:34:12.546 Brent Carlson: The first one is the entity shifting. 00:34:12.553 --> 00:34:13.349 You've got a product. 00:34:13.349 --> 00:34:15.209 It was going to a customer. 00:34:15.209 --> 00:34:19.679 Customer goes on the entity list, then product gets moved over to another 00:34:19.679 --> 00:34:21.419 company, a new white knight customer. 00:34:21.419 --> 00:34:24.429 It could be even straight up in your face a subsidiary or affiliate. 00:34:24.429 --> 00:34:27.399 Those are things where you wanna really look at because like as we described 00:34:27.399 --> 00:34:32.709 before and we described in the NYU PCCE original article, those are red flags 00:34:32.749 --> 00:34:35.209 that need to be mitigated before shipment. 00:34:35.249 --> 00:34:38.279 And again, it's that knowledge with the presence of those red 00:34:38.279 --> 00:34:40.339 flags, that is the trigger itself. 00:34:40.339 --> 00:34:42.809 I think there's been a lot of misunderstanding out there, 'cause 00:34:42.809 --> 00:34:45.459 you can see it in statements that people make where they go, "Well, 00:34:45.459 --> 00:34:48.369 we'll just go work with other partners." Well, what does that mean? 00:34:48.369 --> 00:34:51.979 That's sort of low-hanging fruit out there for people to address. 00:34:52.196 --> 00:34:53.316 Mike Huneke: That's definitely a great one, Brent. 00:34:53.386 --> 00:34:55.646 Absolutely it's something that comes up all the time. 00:34:55.646 --> 00:34:58.216 It has been the subject of enforcement action, so there are 00:34:58.216 --> 00:35:02.116 some publicly available case studies that you can point to when you're 00:35:02.116 --> 00:35:03.446 explaining the risks of this. 00:35:03.691 --> 00:35:06.631 It certainly falls in your classic too good to be true solution 00:35:06.631 --> 00:35:07.991 that requires a bit of scrutiny. 00:35:07.991 --> 00:35:10.011 What's another hypothetical scenario, Brent? 00:35:10.171 --> 00:35:12.001 Brent Carlson: Well, another thing to think about too is selling 00:35:12.001 --> 00:35:13.471 through distributors and resellers. 00:35:13.481 --> 00:35:17.688 So the question here then is, what information, what representations are 00:35:17.688 --> 00:35:21.628 you getting from that distributor or reseller in terms of end use and end user? 00:35:21.628 --> 00:35:25.738 Because by definition, the distributor or reseller is not the end user. 00:35:25.738 --> 00:35:28.418 They're not applying for a specific end use. 00:35:28.758 --> 00:35:33.338 If you're getting strange patterns where order patterns are inconsistent with 00:35:33.338 --> 00:35:38.234 the stated business, volumes don't match the end market, or there's reluctance 00:35:38.274 --> 00:35:43.254 or just opacity in terms of giving end user detail or payment or shipping routes 00:35:43.254 --> 00:35:46.954 that don't line up with the paperwork or business purpose, these would be red 00:35:46.954 --> 00:35:48.904 flags that one should pay attention to. 00:35:49.151 --> 00:35:52.911 Just thinking that, "Oh, the line stops with me selling to my tier one distributor 00:35:52.911 --> 00:35:55.651 and then I'm done," I don't think that's gonna fly in this world anymore. 00:35:55.928 --> 00:35:57.038 Mike Huneke: Exactly right, Brent. 00:35:57.038 --> 00:36:01.598 I'd add to that, that a especially risky situation is one where your 00:36:01.598 --> 00:36:06.478 business model changes right around the time that export controls change or 00:36:06.498 --> 00:36:08.658 a new person or entity is designated. 00:36:08.658 --> 00:36:12.878 I think the worst situation to be in would be one where you had a direct path 00:36:12.878 --> 00:36:16.968 to your customer, something about your item or the customer changes from an 00:36:16.968 --> 00:36:20.878 export controls or sanctions perspective, and suddenly after that moment, you're 00:36:20.878 --> 00:36:22.568 using distributors and resellers. 00:36:22.754 --> 00:36:24.114 Maybe the product's the same. 00:36:24.121 --> 00:36:27.781 Really worst case would be the item is still being customized for that customer, 00:36:27.781 --> 00:36:30.921 but even if it's not, that's the type of thing that when the government sees 00:36:30.921 --> 00:36:35.721 that, whether it's from monitoring trade data, we know they're mining trade data 00:36:35.755 --> 00:36:38.995 to develop cases not only for export controls and sanctions, but trade 00:36:39.015 --> 00:36:41.675 fraud, customs evasion, tariff evasion. 00:36:41.675 --> 00:36:45.035 It's the same topology, just sometimes in a different direction. 00:36:45.165 --> 00:36:48.775 That's a particularly significant risk in the hypothetical when you're talking 00:36:48.775 --> 00:36:50.205 about distributors and resellers. 00:36:50.205 --> 00:36:53.395 Did something about your use of those parties change? 00:36:53.395 --> 00:36:54.055 Brent Carlson: Absolutely. 00:36:54.108 --> 00:36:56.928 Here's another misunderstanding that we see out there too, where it's like, "Oh, 00:36:56.928 --> 00:37:01.498 okay, well, I'm doing a domestic US sale to a front company that may be shipping on 00:37:01.498 --> 00:37:06.748 to places that would not normally pass the license muster or would have red flags." 00:37:06.788 --> 00:37:07.578 Let's just say that. 00:37:07.578 --> 00:37:10.168 A common misunderstanding is, "Oh, well, it's not an export, so 00:37:10.168 --> 00:37:10.878 I don't have to worry about it. 00:37:10.878 --> 00:37:12.048 Companies may not even screen it. 00:37:12.048 --> 00:37:13.928 This is where we have to go back and pay attention. 00:37:13.948 --> 00:37:18.688 First principles, General Prohibition 10 and Section 764.2 in the EAR. 00:37:19.224 --> 00:37:24.401 If that front company is working with or for, let's say, its entity 00:37:24.401 --> 00:37:26.351 listed parent, that's a red flag. 00:37:26.411 --> 00:37:27.938 You cannot just ignore that. 00:37:27.978 --> 00:37:29.198 You have to address that. 00:37:29.238 --> 00:37:33.168 And there's been recent reporting in the news media about that sort of situation. 00:37:33.178 --> 00:37:36.161 How could you have the shipment to a domestic US company and 00:37:36.161 --> 00:37:37.611 have export controls issues? 00:37:37.611 --> 00:37:39.581 Well, hey, what do you think front companies do? 00:37:39.621 --> 00:37:42.671 This is an area that we're gonna see more enforcement because it's 00:37:42.671 --> 00:37:47.154 quite easy for foreign companies to set up a company in the US, have a 00:37:47.154 --> 00:37:49.124 domestic presence, and then work that. 00:37:49.124 --> 00:37:52.944 But also the flip side is that for enforcement, you've got all those 00:37:52.944 --> 00:37:56.184 books and records and the holy power of subpoena available domestically. 00:37:56.184 --> 00:37:59.474 So, I think that's another part where I don't think that's gonna fly too long. 00:37:59.474 --> 00:38:02.950 The key misunderstanding is thinking that, oh, it's a domestic US 00:38:02.970 --> 00:38:06.830 transaction, so there's no export controls risk here that attaches to it. 00:38:06.830 --> 00:38:07.120 No. 00:38:07.120 --> 00:38:12.970 Go back to General Prohibition 10, go back to 764.2, and if it is affiliated in 00:38:12.970 --> 00:38:17.510 any way, shape, or form, with a military end user, a military intelligence end 00:38:17.510 --> 00:38:22.190 user in certain countries, or has any connections with an entity listed company, 00:38:22.190 --> 00:38:23.930 that's something to take a look at. 00:38:23.930 --> 00:38:27.850 Mike Huneke: Yeah, and look, Brent, I think everyone listening, if a US customer 00:38:27.860 --> 00:38:32.393 whose business name was PLA Front Company LLC appeared as a customer, they'd 00:38:32.403 --> 00:38:34.093 have the right reaction and instincts. 00:38:34.273 --> 00:38:37.273 The front companies don't always declare themselves to be such. 00:38:37.273 --> 00:38:40.363 But what are we getting at when we're talking about these risks? 00:38:40.460 --> 00:38:43.700 You have mentioned many times on the pod and in our writing together, 00:38:43.700 --> 00:38:45.540 Brent, diversion starts close to home. 00:38:45.540 --> 00:38:49.580 If you think about the cat and mouse game between smugglers and people who want to 00:38:49.580 --> 00:38:53.140 evade US sanctions and the enforcement authorities, people probably figured out 00:38:53.140 --> 00:38:57.250 that, okay, yeah, if I set up something in the Seychelles and pretend like there's 00:38:57.250 --> 00:39:00.720 a space program there, that might attract attention, might make people nervous. 00:39:00.720 --> 00:39:03.940 But if I'm in California, I'm domestic California business, 00:39:03.940 --> 00:39:05.260 so what is there to worry about? 00:39:05.320 --> 00:39:09.320 We've seen, though, enforcement actions, individuals are facing criminal charges 00:39:09.370 --> 00:39:14.570 where people appeared, the day after the new controls in October twenty twenty-two 00:39:14.570 --> 00:39:18.010 with a dream and a hundred and thirty million dollars in a newly registered 00:39:18.010 --> 00:39:19.890 California company just down the road. 00:39:19.890 --> 00:39:22.270 That's the type of thing that looks really bad when later the 00:39:22.270 --> 00:39:25.030 government asks you, " how were you comfortable screening these guys?" 00:39:25.183 --> 00:39:28.773 We've also seen, and there are public court cases going on in the US right 00:39:28.773 --> 00:39:32.352 now, criminal trials, where somebody thought that it was a domestic 00:39:32.352 --> 00:39:37.252 sale to send something to something with a Global LLC in its name. 00:39:37.302 --> 00:39:40.032 What do you think they're going to do with that stuff? 00:39:40.132 --> 00:39:42.912 That comes back to the article you mentioned, Brent, that was sort of 00:39:42.912 --> 00:39:48.822 an exposé about a US subsidiary of a listed foreign entity just sort of 00:39:48.822 --> 00:39:51.002 renaming itself and staying in place. 00:39:51.002 --> 00:39:54.952 Now, if companies sold to that renamed entity, they should expect that the 00:39:54.952 --> 00:39:58.642 government, especially now getting pressure from Congress, who reacted 00:39:58.642 --> 00:40:02.762 to that New York Times article and undoubtedly will ask questions of US 00:40:02.762 --> 00:40:05.972 government officials in upcoming hearings about what are they doing about it, 00:40:05.972 --> 00:40:10.482 why did you think that the sales after the name change were going to any place 00:40:10.502 --> 00:40:12.092 other than where they were going before? 00:40:12.365 --> 00:40:12.575 If, 00:40:12.585 --> 00:40:17.012 for example, the Chinese parent company had spun off the US entity, it had 00:40:17.052 --> 00:40:20.932 completely separate shareholders, and it changed its business model to 00:40:20.932 --> 00:40:24.942 building a data center in the United States, then that would actually be 00:40:24.942 --> 00:40:26.722 a helpful story to be able to tell. 00:40:26.722 --> 00:40:30.092 If nothing changed and your sales team just told you, "Don't worry, they're 00:40:30.102 --> 00:40:33.992 changing the name, this entity list thing turns on legally distinct corporate 00:40:33.992 --> 00:40:37.812 entities. We think corporate entities actually cure national security risks 00:40:37.812 --> 00:40:41.365 with export controls," if that sounds a little too close to home, as they 00:40:41.365 --> 00:40:45.155 say in the spy movies, your plumbing has a leak and you need to plug it. 00:40:45.389 --> 00:40:47.266 Brent Carlson: It sounds like something almost too good to be true. 00:40:47.266 --> 00:40:48.296 Miracles can happen. 00:40:48.296 --> 00:40:49.196 But be careful. 00:40:49.196 --> 00:40:52.516 Let's talk about remote access, 'cause that's been a hot topic, too. 00:40:52.516 --> 00:40:57.886 So remote access by entities that otherwise would have been barred 00:40:57.896 --> 00:41:02.409 from acquiring the items in the AI tech stack, remote access into data 00:41:02.409 --> 00:41:05.369 centers abroad, and I think that's one piece here that you've seen. 00:41:05.369 --> 00:41:07.399 There are bills that are moving through Congress. 00:41:07.399 --> 00:41:11.579 But that's also an issue here, too, where I think if we go back and look at first 00:41:11.589 --> 00:41:15.789 principles it's actually not, from the government's perspective, quite as a 00:41:15.809 --> 00:41:17.829 arms-up helpless situation as it may be. 00:41:18.406 --> 00:41:21.851 BIS took the position, through advisory opinions in 2009, 2011, 00:41:21.851 --> 00:41:26.611 and 2014, that cloud providers are not exporters under the EAR. 00:41:26.611 --> 00:41:30.966 And That's just a advisory opinion out of BIS that was made under 00:41:30.976 --> 00:41:32.166 conditions that are very different. 00:41:32.176 --> 00:41:34.656 That's before the whole AI world came into being. 00:41:34.839 --> 00:41:37.949 That goes back to our concept of weather-vane compliance, where 00:41:37.949 --> 00:41:40.862 under different situations, different conditions, different 00:41:40.872 --> 00:41:44.442 pressures, regulators could take a very opposite tact very quickly, 00:41:44.442 --> 00:41:45.552 and that's what could happen here. 00:41:45.572 --> 00:41:48.842 BIS could just say, "Look, those advisory opinions no longer apply." That business 00:41:48.842 --> 00:41:52.162 model that they were talking about is very different from what we're talking 00:41:52.162 --> 00:41:57.542 about for access to high-end GPUs through remote access and data centers, 00:41:57.552 --> 00:41:58.912 let's say through Southeast Asia. 00:41:59.082 --> 00:42:03.172 That gets back to thinking about, well, when you're looking at end use and end 00:42:03.182 --> 00:42:05.312 user, what actually is going on here? 00:42:05.312 --> 00:42:09.993 And making sure that from the compliance perspective, companies are thinking about 00:42:10.028 --> 00:42:13.832 the full definition of knowledge under the EAR General Provision 10, and then 00:42:13.832 --> 00:42:17.462 those catch-alls, military end use and especially military intelligence end use. 00:42:17.492 --> 00:42:19.992 Because it's like, what is a data center at the end of the day? 00:42:19.992 --> 00:42:23.485 It gathers, analyzes, facts or data, right? 00:42:23.495 --> 00:42:24.125 Information. 00:42:24.125 --> 00:42:25.665 What does military intelligence do? 00:42:25.675 --> 00:42:28.125 It gathers and analyzes data information. 00:42:28.125 --> 00:42:30.915 It comes down to then, well, what's gonna be the end use? 00:42:30.915 --> 00:42:34.585 That's something where again, those catch-all provisions, the full definition 00:42:34.585 --> 00:42:38.595 of knowledge, and General Provision 10 are things that need to be addressed. 00:42:38.605 --> 00:42:40.205 It's not to say don't do the business. 00:42:40.205 --> 00:42:44.015 But make sure your due diligence to make sure that your company is protecting 00:42:44.015 --> 00:42:48.625 itself in case you've got scrutiny coming down the road or imminently due 00:42:48.625 --> 00:42:50.815 to changing geopolitical conditions. 00:42:50.952 --> 00:42:53.232 Mike Huneke: Yeah, and look, this is gonna continue to be a hot 00:42:53.242 --> 00:42:55.302 topic in the media and in Congress. 00:42:55.302 --> 00:42:59.562 We've talked about the Remote Access Security Act and whether that's going to 00:42:59.572 --> 00:43:04.682 be part of the NDAA, the National Defense Authorization Act, I think is unclear. 00:43:04.682 --> 00:43:07.592 Whether the Senate picks it up on its own, which I think it's sitting 00:43:07.592 --> 00:43:09.242 with the Senate committee, unclear. 00:43:09.243 --> 00:43:11.813 What you're getting at, Brent, and you're right to point out, is that, 00:43:11.813 --> 00:43:16.034 yes, that would be one avenue at least that would clearly grant BIS 00:43:16.034 --> 00:43:16.734 authorization 00:43:16.734 --> 00:43:20.784 to regulate remote access in and of itself, whether or not it is an export. 00:43:20.784 --> 00:43:22.944 They'd still have to exercise that discretion to do 00:43:22.944 --> 00:43:24.214 that, even under that act. 00:43:24.214 --> 00:43:24.424 But 00:43:24.424 --> 00:43:28.464 when all of these things are based on advisory opinions from 12 years ago at 00:43:28.464 --> 00:43:32.714 the latest, there is a risk that they revisit those advisory opinions, or they 00:43:32.714 --> 00:43:37.084 revisit some aspect of them based on, again, what they're seeing out in the 00:43:37.084 --> 00:43:40.404 world in terms of, as you say, kinda what are these being used for and why. 00:43:40.404 --> 00:43:43.500 It doesn't mean it's changed now, and certainly we're not suggesting it has 00:43:43.510 --> 00:43:47.970 already changed, but it is exactly the type of thing that people ought to at 00:43:47.970 --> 00:43:48.120 least 00:43:48.130 --> 00:43:48.900 be thinking about. 00:43:48.910 --> 00:43:53.220 How would we deal with this in terms of what could we stand up quickly in 00:43:53.220 --> 00:43:57.840 terms of actual risk-based compliance programs if that were to happen to us? 00:43:58.037 --> 00:43:59.937 Brent Carlson: In that remote access piece, one thing to just 00:43:59.937 --> 00:44:01.447 keep in mind, think upstream. 00:44:01.447 --> 00:44:05.056 A company, a supplier of pieces of hardware in the AI tech stack can 00:44:05.056 --> 00:44:08.109 say, "Well, I don't have, control over downstream what that data center is 00:44:08.109 --> 00:44:09.389 gonna be doing in Southeast Asia." 00:44:09.723 --> 00:44:13.623 But think about it again from that holistic view a supplier who knew or 00:44:13.623 --> 00:44:17.943 was aware of a high probability that a buyer's business was renting compute to 00:44:17.953 --> 00:44:22.193 customers in an arms embargo destination, that for me raises a knowledge question 00:44:22.243 --> 00:44:25.593 at that point of shipment, and that may not be a gap actually in the law. 00:44:25.593 --> 00:44:27.563 So I think that's something to consider when we're talking about 00:44:27.563 --> 00:44:29.100 the remote access piece as well. 00:44:29.150 --> 00:44:31.360 Mike Huneke: We hope those hypotheticals were useful for everyone. 00:44:31.370 --> 00:44:33.870 Maybe one or more of them actually relate to something you're 00:44:33.870 --> 00:44:34.980 dealing with at the moment. 00:44:35.010 --> 00:44:36.700 We hope that it's helpful in that respect. 00:44:36.700 --> 00:44:40.880 You know, Brent, as we conclude this episode, just in terms of actual nuts and 00:44:40.880 --> 00:44:44.750 bolts of running a compliance program, what should in-house compliance teams be 00:44:44.750 --> 00:44:48.974 thinking of in terms of documentation, preservation, and really equipping 00:44:48.974 --> 00:44:52.414 not only themselves, but maybe someone sitting in their chair after they've been 00:44:52.414 --> 00:44:57.294 promoted, hopefully within a few years to be able to defend against an investigation 00:44:57.294 --> 00:44:58.884 or answer questions from the government? 00:44:58.997 --> 00:44:59.967 Brent Carlson: This is an interesting question. 00:45:00.040 --> 00:45:02.550 You and I have been in, situations where there's been issues where, 00:45:02.550 --> 00:45:05.900 okay, let's not have a written record on something for various reasons. 00:45:05.900 --> 00:45:09.070 But here you wanna have a documented due diligence record. 00:45:09.110 --> 00:45:12.140 So you wanna make sure, number one, that you're documenting that you're 00:45:12.140 --> 00:45:15.250 incorporating the knowledge standard or the full definition of knowledge under 00:45:15.250 --> 00:45:18.670 the EAR, which includes an awareness of high probability, in the compliance 00:45:18.670 --> 00:45:20.560 programs, policies, and procedures. 00:45:20.560 --> 00:45:23.807 You wanna make sure then, too, you're identifying and diligencing these risks. 00:45:23.807 --> 00:45:25.857 That's what that Fraud Four-Circle Framework can do. 00:45:25.867 --> 00:45:29.407 It evolved from the classic fraud triangle, now you have the Fraud 00:45:29.417 --> 00:45:33.117 Four-Circle Framework in dealing with due diligence and forward-looking situations. 00:45:33.290 --> 00:45:36.850 Make sure you have that, and then look at those changes in the business. 00:45:36.850 --> 00:45:39.757 When something changed and there's something that changed with the customers, 00:45:39.767 --> 00:45:43.587 with the regulations, look for the changes that occurred around those trigger events. 00:45:43.637 --> 00:45:46.197 That's when you wanna make sure and that you document it if and 00:45:46.197 --> 00:45:48.137 when regulators do come knocking. 00:45:48.444 --> 00:45:51.634 One of the bills out there is to extend the statute of limitations for EAR 00:45:52.174 --> 00:45:55.944 from five to 10 years to align it with OFAC violations, so there's a long 00:45:55.944 --> 00:45:57.934 tail to that, and people can change. 00:45:58.060 --> 00:46:01.040 If you're in a situation where the government comes and say, " We've 00:46:01.040 --> 00:46:02.950 identified these shipments. 00:46:02.950 --> 00:46:04.330 There's red flags here. 00:46:04.330 --> 00:46:07.030 What did you do to address and mitigate them?" It goes back to 00:46:07.030 --> 00:46:08.200 the high school homework thing. 00:46:08.200 --> 00:46:10.030 If you didn't do your homework, it's a zero. 00:46:10.030 --> 00:46:11.550 You can't show it, that's a zero. 00:46:11.550 --> 00:46:12.520 That's gonna be a big problem. 00:46:12.530 --> 00:46:16.140 You wanna have that documented with a clear framework, with a methodology 00:46:16.140 --> 00:46:19.690 that's defendable so you end up protecting yourself with the legal 00:46:19.690 --> 00:46:22.738 and compliance people, the company, and its officers and directors. 00:46:22.768 --> 00:46:24.978 Mike Huneke: Brent is always super helpful and interesting. 00:46:25.008 --> 00:46:27.958 That brings us to this episode's managing up. 00:46:27.958 --> 00:46:30.608 What is your managing up advice for today? 00:46:30.755 --> 00:46:33.905 Brent Carlson: In a world of chaos and confusion, go back to the basics. 00:46:33.965 --> 00:46:37.795 It's like we talked about in the episode pull, push, tap, aim, fire. 00:46:37.795 --> 00:46:38.685 Go back to the basics. 00:46:38.775 --> 00:46:42.671 If it's things look really confusing, go back and boil it down. 00:46:42.671 --> 00:46:48.431 If something appears complex or overly complex, go back to first principles. 00:46:48.521 --> 00:46:51.541 Get down to where you could break that down into components and 00:46:51.541 --> 00:46:56.200 understand where the through line of real risk lies and avoiding that. 00:46:56.447 --> 00:46:57.737 Mike Huneke: Brent, well said as always. 00:46:57.737 --> 00:47:00.237 That concludes this episode of Red Flags Rising. 00:47:00.237 --> 00:47:02.017 For everyone out there, thanks for listening. 00:47:02.027 --> 00:47:02.477 Be well. 00:47:02.632 --> 00:47:04.342 Brent Carlson: Thanks, Mike, and thanks to everyone out there. 00:47:04.342 --> 00:47:04.612 Be well.