On March 15, 2018, the US Office of Foreign Assets Control (“OFAC”) added 14 individuals and one entity, the so-called Russian “troll farm” Internet Research Agency LLC (“IRA”), to the Specially Designated Nationals and Blocked Persons List (“SDN List”). OFAC announced a total of 24 designations against persons pursuant to Executive Order (“EO”) 13694 (issued April 1, 2015 and amended December 29, 2016), which is the “Cyber EO” that targets certain “malicious cyber-enabled activities,” and pursuant to Section 224 of the Countering America’s Adversaries Through Sanctions Act (“CAATSA”) , which specifically targets cyber actors who operate on behalf of the Russian government. Nine of the 24 persons identified in OFAC’s announcement were already included on the SDN List. Please see our prior blog post on CAATSA here and prior blog posts on the Cyber EO and its amendment here, here, and here.
As a result of these designations, “US Persons” (i.e., (i) US citizens and permanent resident aliens / Green Card holders, wherever located or employed; (ii) entities organized under the laws of the United States, their non-US branches, and employees of the foregoing; and (iii) any individual or entity physically located in the United States, even temporality) are prohibited from directly or indirectly dealing with or facilitating virtually any transactions with these SDNs as well as any entities 50% or more owned by them. Any property and interests in property of such SDNs must also be blocked (or “frozen”) if they come within the United States or the possession or control of a US Person, including but not limited to a US financial institution clearing or otherwise handling US dollar transactions that involve these SDNs.
In its press release, OFAC stated that these designations are part of the US Government’s efforts to counter malicious Russian cyber activity, including interference in the 2016 US elections, destructive cyber attacks including the NotPetya ransomware attack, and cyber intrusions targeting US critical infrastructure. OFAC’s announcement was made on the same day that the Department of Homeland Security and the Federal Bureau of Investigation issued a joint Technical Alert regarding Russian cyber attacks on the US energy, nuclear, water, aviation, and manufacturing sectors.
EO 13694 Designations
OFAC designated the IRA along with two other entities and 13 individuals associated with the IRA pursuant to EO 13694. These parties were the subject of the indictment announced on February 16, 2018 by the Special Counsel for the Department of Justice investigating Russian interference in the 2016 US election. OFAC’s press release states that the IRA tampered with or altered information in order to interfere with the 2016 US election, and unlawfully used personally identifiable information from US Persons to open financial accounts to help fund its operations.
In addition to the EO 13694 designations, OFAC designated two entities and six individuals pursuant to Section 224 of CAATSA. The designated entities are the Federal Security Service (“FSB”) and the Main Intelligence Directorate (“GRU”), both of which were previously designated as SDNs under EO 13694 (as amended).
Cyber General License No. 1A
In conjunction with the designations described above, OFAC amended Cyber General License No. 1, “Authorizing Certain Transactions with the Federal Security Service” (“GL 1”) and reissued it as Cyber General License No. 1A (“GL 1A”) to add CAATSA authorities and ensure the scope of activities authorized with respect to the FSB would not be affected by its additional designation under Section 224 of CAATSA. GL 1A continues to authorize certain limited, primarily administrative, transactions with the FSB. Our blog post on GL 1 can be found here.