Schneier on Security

A blog covering security and security technology.

« Friday Squid Blogging: Where to Get Your Pet Squid | Main | KittenAuth »

April 10, 2006

No-Buy List

You've all heard of the "No Fly List." Did you know that there's a "No-Buy List" as well?

The so-called "Bad Guy List" is hardly a secret. The U.S. Treasury's Office of Foreign Assets Control maintains its "Specially Designated Nationals and Blocked Persons List" to be easily accessible on its public Web site.

Wanna see it? Sure you do. Just key OFAC into your Web browser, and you'll find the 224-page document of the names of individuals, organizations, corporations and Web sites the feds suspect of terrorist or criminal activities and associations.

You might think Osama bin Laden should be at the top of The List, but it's alphabetized, so Public Enemy No. 1 is on Page 59 with a string of akas and spelling derivations filling most of the first column. If you're the brother, daughter, son or sister-in-law of Yugoslavian ex-president Slobodan Milosevic (who died in custody recently), you're named, too, so probably forget about picking up that lovely new Humvee on this side of the Atlantic. Same for Charles "Chuckie" Taylor, son of the recently arrested former president of Liberia (along with the deposed prez's wife and ex-wife).

The Bad Guy List's relevance to the average American consumer? What's not widely known about it is that by federal law, sellers are supposed to check it even in the most common and mundane marketplace transactions.

"The OFAC requirements apply to all U.S. citizens. The law prohibits anyone, not just car dealers, from doing business with anyone whose name appears on the Office of Foreign Assets Control's Specially Designated Nationals list," says Thomas B. Hudson, senior partner at Hudson Cook LLP, a law firm in Hanover, Md., and publisher of Carlaw and Spot Delivery, legal-compliance newsletters and services for car dealers and finance companies.

Hudson says that, according to the law, supermarkets, restaurants, pawnbrokers, real estate agents, everyone, even The Washington Post, is prohibited from doing business with anyone named on the list. "There is no minimum amount for the transactions covered by the OFAC requirement, so everyone The Post sells a paper to or a want ad to whose name appears on the SDN list is a violation," says Hudson, whose new book, "Carlaw -- A Southern Attorney Delivers Humorous Practical Legal Advice on Car Sales and Financing," comes out this month. "The law applies to you personally, as well."

But The Bad Guy List law (which predates the controversial Patriot Act) not only is "perfectly ridiculous," it's impractical, says Hudson. "I understand that 95 percent of the people whose names are on the list are not even in the United States. And if you were a bad guy planning bad acts, and you knew that your name was on a publicly available list that people were required to check in order to avoid violating the law, how dumb would you have to be to use your own name?"

Compliance is also a big problem. Think eBay sellers are checking the list for auction winners? Or that the supermarket checkout person is thanking you by name while scanning a copy of The List under the counter? Not likely.

Posted on April 10, 2006 at 6:23 AM • 35 Comments

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.