Introduction

Open source is a fundamental part of software supply chains and production systems. As such, it has reached a stage of maturity that requires new ways to deal with a complex world. The Linux Foundation has always pushed to promote and protect open collaboration in open source software and open standards-related activities. The model of allowing the brightest technical minds from around the world to contribute to an open commons has repeatedly proven its value over the past few decades. Protecting this commons is essential and something the Linux Foundation will continue to defend.

However, increased cybersecurity risk and regulatory compliance are creating burdens on open source communities that must be met. There are newer regulations such as the EU’s Cyber Resilience Act, where we and others in the open source ecosystem invested great energy to educate regulators on the issues and concerns and carve out explicit exemptions for open source. Sanctions regulations are often very old regulations that never contemplated exemptions for the type of open collaboration that underpins modern daily life, societal systems, and business. The Linux Foundation is committed to open source and global collaboration and doing so responsibly while complying with laws and regulations where the foundation and our community members operate. Understanding the legal frameworks within which we all collaborate is essential to maintaining global collaboration.

One of these areas is trade and sanctions regulations many countries have enacted. Many of these trade and sanctions regulations were enacted decades ago but have more recently been used to target technology providers. While there are sanctions programs in place around the globe, many developers will need to be mindful of laws and regulations like U.S. OFAC (Office of Foreign Assets Control) sanctions. Issues involving OFAC sanctions programs and open source are not very common, but are important to be aware of. These sanctions regulate interactions (or, in their word, “transactions”) with specific countries, entities, and individuals.

OFAC sanctions issues are not commonly seen or understood in open source communities. They target a specific list of entities, individuals, countries, or regions. Historically those targets were not engaged in open source communities. With the U.S. and international sanctions targeting technology companies based in Russia, this issue has become a topic in certain open source communities that have participation from entities targeted by such sanctions.

The following information is shared to generate awareness of the issues that may arise and current compliance obligations. This guide is not intended to provide legal advice and we encourage you to seek advice from your legal counsel if you should run into any issues or have any questions. The points raised in this article are intended for developers who need to follow the U.S. sanctions laws or who want to collaborate with others who are required to follow U.S. sanctions laws. Developers and companies operating in open source outside the U.S. will need to determine which sanctions laws are applicable and relevant to themselves and their project communities. Such a determination likely requires consulting with a legal counsel or your employer’s legal team.