Barracuda Networks OFAC Settlement: $38.9K (2015)

From August 2009 to April 2012, Barracuda U.K. sold Web filtering products (including products that could be used to block or censor Internet activity), internet security products, and related software subscriptions to individuals and entities in Iran and Sudan, and to Specially Designated Nationals and Blocked Persons ("SDNs") under the Syrian Regulations. From August 2009 to May 2012, Barracuda U.S. provided firmware and software updates for these and other software subscriptions. The total transaction value for the alleged violations was $123,586.

Barracuda permitted distributors and resellers to sell its products and updates to SDNs and to customers in sanctioned countries when it knew or had reason to know that the products were located in sanctioned countries or with SDNs. Barracuda knew or had reason to know that it was exporting goods, technology, and services to Iran and Sudan because IP addresses associated with those countries were used to contact the company; further, Barracuda knew or had reason to know that it was exporting technology to Syrian SDNs because the SDNs were listed on sales invoices. The exportation of Web filtering software and hardware to Iran, Sudan, and SDNs in Syria could potentially have caused significant harm to U.S. sanctions program objectives because the technology could have been used to block or censor Internet activity.

The apparent violations occurred prior to the issuance of General License D for the ITSR (issued May 13, 2013, superseded by GL-D-1 on February 7, 2014) and the February 18, 2015 amendment to § 538.533 of the Sudanese Sanctions Regulations; at least some of the transactions would likely have been authorized had they occurred after these general licenses were issued.

OFAC determined that Barracuda voluntarily self-disclosed the alleged violations and that the alleged violations constitute a non-egregious case. The settlement amount of $38,930 reflects OFAC's consideration of facts and circumstances pursuant to the General Factors under OFAC's Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A. Barracuda had no prior OFAC sanctions history, including no penalty notice or Finding of Violation in the five years preceding the earliest date of the transactions, making it eligible for up to 25 percent "first offense" mitigation. Barracuda substantially cooperated with OFAC's investigation, including by agreeing to toll the statute of limitations for approximately 521 days.

Barracuda distributed its products and technology to more than 17,000 resellers and distributors worldwide without implementing any written sanctions compliance policies or procedures and without providing training to its employees regarding export controls and sanctions. Barracuda also did not screen IP addresses used to contact its servers because it had no OFAC compliance program in place at the time of the transactions.

In response, Barracuda took significant remedial steps including developing a method to disable products in sanctioned countries, prioritizing U.S. sanctions and export controls compliance by establishing an Office of Trade Compliance and hiring a general counsel with subject matter expertise in these areas, issuing a company-wide statement from the CEO about sanctions-related policy, implementing a trade compliance manual, and enhancing its sales software to include red flags for orders that may require a license.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.