Apple pays $467,000 settlement for accidental U.S. sanctions violation

Posted:
in General Discussion edited November 2019
Apple says that it had inadvertently paid a blacklisted software company, violating U.S. sanctions, but has rectified the situation after working with officials.

Apple agrees to pay $467k for dealing with an entity blacklisted by the U.S.


Apple will pay a settlement of $467,000 to acknowledge its violation of U.S. sanctions, according to the Treasury Department.

The company in question was Slovenian software company SIS d.o.o., owned by Savo Stjepanovic. SIS has been implicated in an international steroid trafficking network, earning them a spot on the U.S. Treasury's List of Specially Designated Nationals.

Apple allegedly had entered into an app development agreement with SIS, and paid them 47 times over the course of two years, according to the Wall Street Journal. The payments were made to the company's blocked apps, with Apple collecting roughly $1.2 million from SIS's customers.

The U.S. Office of Foreign Assets Control (OFAC) believes that the two-year long relationship highlights multiple points of failure within Apple's sanctions compliance program, going on to say that it showed "reckless disregard for U.S. sanctions requirements."

The slip-up occurred when Apple's system had listed Stjepanovic's company as "SIS DOO," rather than "SIS d.o.o," as it read on the OFAC's list, according to the agreement. Apple had also failed to identify Stjepanovic as a blacklisted individual.

Later, Apple had allegedly help transfer the ownership of SIS's apps to two other companies after the designation had been made.

In February 2017, Apple had identified the company as a blacklisted entity and suspended payments to the company, but continued to make payments to the other company that owned some of the SIS apps for several months.

Apple had voluntarily disclosed the alleged violations, according to the OFAC.

"In 2017, we found that we had inadvertently paid a developer on [the] U.S. Treasury's List of Specially Designated Nationals," an Apple spokesman said in a statement Monday. "We reported it to the authorities and fully cooperated with their investigation, which has now been completed."

The OFAC concluded the case was non-egregious, and cited that Apple had made changes to its compliance program. The changes included increasing the role of the company's global export and sanction compliance, which would expand sanction screening.

Comments

  • Reply 1 of 17
    Wrist slap.
  • Reply 2 of 17
    DAalsethDAalseth Posts: 2,783member
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    pscooter63lkrupprandominternetpersondkhaleyRayz2016badmonkFileMakerFellerStrangeDaysmacguiwatto_cobra
  • Reply 3 of 17
    MacProMacPro Posts: 19,728member
    Very professionally handled by Apple.
    spice-boylkruppbadmonkStrangeDayswatto_cobra
  • Reply 4 of 17
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    It's more than a typo, it's a poorly designed system that would fail to identify obvious attempts to get around the sanctions list. This is exactly what HSBC was fined $2B for when they were used as an intermediary for terrorist and other criminal groups. Illegal organisations just put random dots in their names, knowing it wouldn't get flagged. HSBC was almost complicit though as they knew it was happening.

    I'd probably argue that half a billion dollars is more than a wrist slap and probably an overreaction unless Apple had been warned or was doing this intentionally. I'm sure they'll now spend a few thousand dollars designing a system that better flags these companies.
    spice-boy
  • Reply 5 of 17
    "Slip-up"


  • Reply 6 of 17
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    It's more than a typo, it's a poorly designed system that would fail to identify obvious attempts to get around the sanctions list. This is exactly what HSBC was fined $2B for when they were used as an intermediary for terrorist and other criminal groups. Illegal organisations just put random dots in their names, knowing it wouldn't get flagged. HSBC was almost complicit though as they knew it was happening.

    I'd probably argue that half a billion dollars is more than a wrist slap and probably an overreaction unless Apple had been warned or was doing this intentionally. I'm sure they'll now spend a few thousand dollars designing a system that better flags these companies.
    You mean “half a million”, don’t you?

    And it’s not a few thousands to design a system. It’s around couple of millions to design a system which flags such companies. 
    randominternetpersoncornchipwatto_cobra
  • Reply 7 of 17
    sdw2001sdw2001 Posts: 18,016member
    "The U.S. Office of Foreign Assets Control (OFAC) believes that the two-year long relationship highlights multiple points of failure within Apple's sanctions compliance program, going on to say that it showed "reckless disregard for U.S. sanctions requirements."


    Welcome to this episode of Why People Hate Government.  A reckless disregard?  It was a data entry error that they self-reported and corrected.  Good lord.  
    randominternetpersoncornchipFileMakerFellerwatto_cobranetmagenetrox
  • Reply 8 of 17
    MplsPMplsP Posts: 3,931member
    Ouch - that was a half million dollar typo! 

    Stinks for Apple, but I agree with Dalseth - they made a mistake. They reported it and owned it. Time to move on. 
    watto_cobra
  • Reply 9 of 17
    realisticrealistic Posts: 1,154member
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    It's more than a typo, it's a poorly designed system that would fail to identify obvious attempts to get around the sanctions list. This is exactly what HSBC was fined $2B for when they were used as an intermediary for terrorist and other criminal groups. Illegal organisations just put random dots in their names, knowing it wouldn't get flagged. HSBC was almost complicit though as they knew it was happening.

    I'd probably argue that half a billion dollars is more than a wrist slap and probably an overreaction unless Apple had been warned or was doing this intentionally. I'm sure they'll now spend a few thousand dollars designing a system that better flags these companies.
    The fine was roughly half a million not half a billion.
  • Reply 10 of 17
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    They finally caught it... after 2 years.  They admitted it.  They owned it.  That's good.  That's how it should have been handled.  It shouldn't have gotten that far though.  But this was more than just a typo. One would have to overlook a few other important facts to come to that conclusion. More accurately, it wasn't a typo per se.  It was a software failure.  Apple's software scan failed to pattern match and flag "d.o.o." with "DOO".  Pretty sure that's the first thing they probably corrected.  Beyond the typographical error, they failed to identify the owner as blacklisted.  Compounding the first two errors, they also helped transfer ownership of the apps to other companies after the blacklisting.  They stopped paying the old company, but continued to pay the new companies.  So that typo exposed multiple failure points that allow the payments to continue unabated for 2 years.  Remember, this started in 2015.  

    sdw2001 said:
    "The U.S. Office of Foreign Assets Control (OFAC) believes that the two-year long relationship highlights multiple points of failure within Apple's sanctions compliance program, going on to say that it showed "reckless disregard for U.S. sanctions requirements."


    Welcome to this episode of Why People Hate Government.  A reckless disregard?  It was a data entry error that they self-reported and corrected.  Good lord.  

    "The OFAC concluded the case was non-egregious, and cited that Apple had made changes to its compliance program." - article.  
    They were as unnecessarily hyperbolic with their "reckless disregard" as you were with your "Good lord".  
    It wasn't a data entry error, but even if we classify as one, shouldn't it be fully classifed?  As in, a 2 year undetected data error that lead to $1.2M in payouts.  In the grand scheme is it a big deal?  Certainly not.  But the level of downplaying in this thread is kinda lol.
    edited November 2019 philboogie
  • Reply 11 of 17
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    It's more than a typo, it's a poorly designed system that would fail to identify obvious attempts to get around the sanctions list. This is exactly what HSBC was fined $2B for when they were used as an intermediary for terrorist and other criminal groups. Illegal organisations just put random dots in their names, knowing it wouldn't get flagged. HSBC was almost complicit though as they knew it was happening.

    I'd probably argue that half a billion dollars is more than a wrist slap and probably an overreaction unless Apple had been warned or was doing this intentionally. I'm sure they'll now spend a few thousand dollars designing a system that better flags these companies.
     half a billion dollars”
    $467,000

  • Reply 12 of 17
    sdw2001sdw2001 Posts: 18,016member
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    They finally caught it... after 2 years.  They admitted it.  They owned it.  That's good.  That's how it should have been handled.  It shouldn't have gotten that far though.  But this was more than just a typo. One would have to overlook a few other important facts to come to that conclusion. More accurately, it wasn't a typo per se.  It was a software failure.  Apple's software scan failed to pattern match and flag "d.o.o." with "DOO".  Pretty sure that's the first thing they probably corrected.  Beyond the typographical error, they failed to identify the owner as blacklisted.  Compounding the first two errors, they also helped transfer ownership of the apps to other companies after the blacklisting.  They stopped paying the old company, but continued to pay the new companies.  So that typo exposed multiple failure points that allow the payments to continue unabated for 2 years.  Remember, this started in 2015.  

    sdw2001 said:
    "The U.S. Office of Foreign Assets Control (OFAC) believes that the two-year long relationship highlights multiple points of failure within Apple's sanctions compliance program, going on to say that it showed "reckless disregard for U.S. sanctions requirements."


    Welcome to this episode of Why People Hate Government.  A reckless disregard?  It was a data entry error that they self-reported and corrected.  Good lord.  

    "The OFAC concluded the case was non-egregious, and cited that Apple had made changes to its compliance program." - article.  
    They were as unnecessarily hyperbolic with their "reckless disregard" as you were with your "Good lord".  
    It wasn't a data entry error, but even if we classify as one, shouldn't it be fully classifed?  As in, a 2 year undetected data error that lead to $1.2M in payouts.  In the grand scheme is it a big deal?  Certainly not.  But the level of downplaying in this thread is kinda lol.

    I'm not being hyperbolic.  That's my reaction to their hyperbole.   "Good lord."  
    watto_cobranetmage
  • Reply 13 of 17
    sdw2001 said:
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    They finally caught it... after 2 years.  They admitted it.  They owned it.  That's good.  That's how it should have been handled.  It shouldn't have gotten that far though.  But this was more than just a typo. One would have to overlook a few other important facts to come to that conclusion. More accurately, it wasn't a typo per se.  It was a software failure.  Apple's software scan failed to pattern match and flag "d.o.o." with "DOO".  Pretty sure that's the first thing they probably corrected.  Beyond the typographical error, they failed to identify the owner as blacklisted.  Compounding the first two errors, they also helped transfer ownership of the apps to other companies after the blacklisting.  They stopped paying the old company, but continued to pay the new companies.  So that typo exposed multiple failure points that allow the payments to continue unabated for 2 years.  Remember, this started in 2015.  

    sdw2001 said:
    "The U.S. Office of Foreign Assets Control (OFAC) believes that the two-year long relationship highlights multiple points of failure within Apple's sanctions compliance program, going on to say that it showed "reckless disregard for U.S. sanctions requirements."


    Welcome to this episode of Why People Hate Government.  A reckless disregard?  It was a data entry error that they self-reported and corrected.  Good lord.  

    "The OFAC concluded the case was non-egregious, and cited that Apple had made changes to its compliance program." - article.  
    They were as unnecessarily hyperbolic with their "reckless disregard" as you were with your "Good lord".  
    It wasn't a data entry error, but even if we classify as one, shouldn't it be fully classifed?  As in, a 2 year undetected data error that lead to $1.2M in payouts.  In the grand scheme is it a big deal?  Certainly not.  But the level of downplaying in this thread is kinda lol.

    I'm not being hyperbolic.  That's my reaction to their hyperbole.   "Good lord."  
    Fair enough.
  • Reply 14 of 17
    realistic said:
    DAalseth said:
    Wrist slap.
    Yes as it should be. It was a minor infraction due to a typo. Apple reported it to officials as soon as they discovered that it had happened. They admitted it, they owned it, they have taken steps to keep it from happening again.
    It's more than a typo, it's a poorly designed system that would fail to identify obvious attempts to get around the sanctions list. This is exactly what HSBC was fined $2B for when they were used as an intermediary for terrorist and other criminal groups. Illegal organisations just put random dots in their names, knowing it wouldn't get flagged. HSBC was almost complicit though as they knew it was happening.

    I'd probably argue that half a billion dollars is more than a wrist slap and probably an overreaction unless Apple had been warned or was doing this intentionally. I'm sure they'll now spend a few thousand dollars designing a system that better flags these companies.
    The fine was roughly half a million not half a billion.
    Yeah I must have been drunk when I looked at the number :) so that makes more sense. But the main point about it not just being a typo problem stands. A company that claims to be investing in AI and security should be able to distinguish between something with or without a few full stops in it.
  • Reply 15 of 17
    Until humans achieve perfection, software will not achieve perfection. Writing pattern matching expressions for internal tools to catch any & all edge cases is not trivial as you have to think of the edge cases first in order to codify them, but I'm sure this self-discovered & reported error will help improve the pattern matching expressions used. 
    watto_cobranetmage
  • Reply 16 of 17
    It doesn’t require pattern matching, it requires using the proper kind of comparison, which in this case probably should have been something like an edit distance (Damerau–Levenshtein) algorithm that flags possible matches for human verification. 
  • Reply 17 of 17
    rcfarcfa Posts: 1,124member
    And what are/were the apps in question?
Sign In or Register to comment.