SAP SE, a global software company headquartered in Waldorf, Germany, has agreed to pay combined penalties of more than $8 million as part of a global resolution with the Departments of Justice, Commerce, and the Treasury.

In voluntary disclosures the Company made to the three agencies, SAP acknowledged violations of the Export Administration Regulations and the Iranian Transactions and Sanctions Regulations. As a result of its voluntary disclosure to DOJ, extensive cooperation, and remediation costing more than $27 million, United States Attorney’s Office for the District of Massachusetts and DOJ’s National Security Division entered into a Non-Prosecution Agreement with SAP. Pursuant to that agreement, SAP will disgorge $5.14 million of ill-gotten gain.

Beginning in approximately January 2010 and continuing through approximately September 2017, SAP, without a license, willfully exported, or caused the export, of its products to Iranian users. SAP’s violations occurred in two principle ways.

First, between 2010 and 2017, SAP and its overseas partners released its U.S-origin software, including upgrades, and/or software patches more than 20,000 times to users located in Iran. SAP senior management was aware that neither the Company nor its U.S.-based Content Delivery Provider used geolocation filters to identify and block Iranian downloads, yet for years the Company did nothing to remedy the issue. The vast majority of the Iranian downloads went to 14 companies, which SAP Partners in Turkey, United Arab Emirates, Germany, and Malaysia knew were Iranian-controlled front companies. The remaining downloads went to several multinational companies with operations in Iran, which downloaded SAP’s software, updates, and/or patches from locations in Iran.

Second, from approximately 2011 to 2017, SAP’s Cloud Business Group companies (CBGs) permitted approximately 2,360 Iranian users to access U.S.-based cloud services from Iran. Beginning in 2011, SAP acquired various CBGs and became aware, through pre-acquisition due diligence as well as post-acquisition export control-specific audits, that these companies lacked adequate export control and sanctions compliance processes. Yet, SAP made the decision to allow these companies to continue to operate as standalone entities after acquiring them and failed to fully integrate them into SAP’s more robust export controls and sanctions compliance program.

While this conduct constituted serious violations of U.S. law involving the release of U.S. origin technology and software through cloud servers and online portals, this Non-Prosecution Agreement recognizes the importance of voluntary self-disclosure and cooperation with the government. DOJ and the District of Massachusetts reached this resolution with SAP based upon its voluntary self-disclosure as well as SAP’s extensive internal investigation and cooperation over a three-year period. During this time, SAP worked with prosecutors and investigators, producing thousands of translated documents, answering inquiries, and making foreign-based employees available for interviews in a mutually agreed upon overseas location. AP also timely remediated and implemented significant changes to its export compliance and sanctions program, spending more than $27 million on such changes, including, among other things detailed in the NPA: (1) implementing GeoIP blocking; (2) deactivating thousands of individuals users of SAP cloud based services based in Iran; (3) transitioning to automated sanctioned party screening of its CBGs; (4) auditing and suspending SAP partners that sold to Iran-affiliated customers; and (5) conducting more robust due diligence at the acquisition stage by requiring new acquisitions to adopt GeoIP blocking and requiring involvement of the Export Control Team before acquisition.

Concurrently with this agreement, SAP is entering into Administrative Agreements with the Department of Commerce, Bureau of Industry and Security (“BIS”) and the Department of the Treasury, Office of Foreign Assets Control (“OFAC”). Among other things, the BIS settlement agreement requires SAP to conduct internal audits of its compliance with U.S. export control laws and regulations, and produce audit reports to BIS for a period of three years.

“Today, SAP has admitted to thousands of export violations spanning six years that violated the U.S. embargo against Iran and endangered the national security of the United States,” said Acting U.S. Attorney Nathaniel Mendell. “This settlement should serve as a strong deterrent message to others that the release of software and sale of product and services on the internet are subject to U.S. export laws and regulations.”

“Today’s first-ever resolution pursuant to the Department’s Export Control and Sanctions Enforcement Policy for Business Organizations sends a strong message that businesses must abide by export control and sanctions laws, but that when they violate those laws, there is a clear benefit to coming to the Department before they get caught,” said Assistant Attorney General John C. Demers for the National Security Division. “SAP will suffer the penalties for its violations of the Iran sanctions, but these would have been far worse had they not disclosed, cooperated, and remediated. We hope that other businesses, software or otherwise, we heed this lesson.”

“This action demonstrates that the Office of Export Enforcement will continue to leverage our unique authorities to enforce our nation’s export control laws and to deter new violations. Violators of the EAR will be held accountable through criminal, civil penalties, or both when appropriate,” said William Higgins, Special Agent in Charge of the Department of Commerce’s Office of Export Enforcement, Boston Field Office. “These laws are designed to protect U.S. Foreign Policy and National Security and will be vigorously investigated.”

“By supplying Iran with millions of dollars’ worth of illegally exported software and services, SAP circumvented U.S. economic sanctions against Iran—pressure that is intended to end Iran’s malign behavior. However, it was SAP that first uncovered and reported this sanctions violation, and we would like to thank them for working hard to enhance their compliance program to prevent future violations,” said Joseph R. Bonavolonta, Special Agent in Charge of the Federal Bureau of Investigation, Boston Division. “Let this case be a lesson to others that it’s better to self-report and own up to one’s mistakes than undermine U.S. foreign policy and adversely affect our national security.”

“Among HSI’s priorities is the commitment to ensuring that sensitive U.S. products, to include software, are not illegally exported to embargoed destinations, such as Iran,” said William S. Walker, Acting Special Agent in Charge for Homeland Security Investigations, Boston. “It will continue to be incumbent upon U.S. companies to guarantee that foreign subsidiaries dealing in their products remain in compliance with U.S. sanctions and export control regulations. HSI will continue to coordinate with our law enforcement partners to safeguard sensitive technologies produced in the United States from ending up in the hands of our adversaries.”

Acting U.S. Attorney Mendell, Assistant Attorney General John Demers, SAC William Higgins, SAC Bonavolonta, and Acting SAC William Walker made the announcement today. Assistant U.S. Attorney B. Stephanie Siegmann, Chief of Mendell’s National Security Unit; Elizabeth Cannon, Deputy Chief of Export Controls and Sanctions, National Security Division; and Heather Schmidt, Senior Trial Attorney, National Security Division, oversaw this investigation and negotiated this agreement.

BSA the Software Alliance, a global trade association of software publishers, warns that the use of unlicensed software poses serious security, business and legal risks to the users and their industries.

BSA’s “Legalise and Protect” campaign sees it working with governments and other partners to educate companies about the significant risks they face when they use software that is not genuine or not fully licensed.

BSA members’ software products are used in a wide range of industries, including manufacturing, IT, finance, professional services, construction, healthcare, consumer goods, engineering, architecture and design.

BSA is working with the Thai government, using its database of thousands of companies in Thailand under watch for possible violations.

In coming months BSA will launch public education efforts to ensure business leaders are aware of the risks of using unlicensed software.

“By legalising their software, companies can protect data security, protect competitiveness, protect their reputations – and protect against the risk of legal consequences,” said BSA senior director Tarun Sawney. “The sooner companies legalise, the sooner they can protect their operations and ultimately protect their bottom lines.”

The Asia-Pacific region has the highest rate of unlicensed software use in the world at 57 per cent. A problem of this scale is best tackled by changing minds and behaviour to encourage self-regulation and voluntary compliance, Tarun said.

BSA has thus oriented its campaign primarily to discourage companies from installing and using unlicensed or illegal software – not just for fear of enforcement, but because it is in their best interests to do so.

India is one of the U.S. technology firm’s biggest markets in Asia, yet over half of all software installed on computers in the country is unlicensed, advocacy group Business Software Alliance said in 2016.

A pirated compact disc of Microsoft’s Windows 10 can be bought for around $2 in New Delhi, compared with $130 needed to buy the operating system from Microsoft’s online portal.

To ensure compliance, Microsoft runs a global “software asset management” (SAM) programme under which it partners global consultants, such as KPMG in India, which seek permission from business owners to check for the use of unlicensed software.

Last month, Vinit Goenka, a member of the Bharatiya Janata Party (BJP) and technology adviser to the government, complained to both companies that a KPMG employee “barged in” to his Mumbai recruitment firm without an appointment to check its software, according to emails reviewed by Reuters.

Rajiv Sodhi, a senior Microsoft India executive, told Goenka in a March 20 email that the company was looking at the issue with “utmost seriousness”.

“We are also getting an assessment agency to carry out an audit of the process delivery at KPMG to identify and correct gaps, if any,” Sodhi wrote in the email reviewed by Reuters.

Sodhi did not respond to a request for comment.

Microsoft told Reuters its SAM programme is run as per global standards, while KPMG said it follows “appropriate procedures agreed in our engagement with clients”. Both declined to comment on the alleged incident and probe.

The employee, who identified himself in the emails as Srijesh, declined to comment.

Goenka confirmed the incident and complaint, telling Reuters the handful of computers at his company, Ratein Infotech, used genuine software. He said he planned to file a police complaint against both companies.

Ratein Infotech last month received a letter from the U.S. software firm saying it needed help in “interpreting licensing policies of Microsoft”, the emails showed. The issue escalated when the KPMG employee entered Ratien’s office on March 15.

Microsoft and KPMG apologised and the employee, Srijesh, resigned, the e-mails showed.

“This is part of my regular job, that I do on a daily basis as directed by KPMG and Microsoft,” Srijesh wrote in an apology email to Goenka, seen by Reuters.

Goenka is a former employee of International Business Machines Corp and advises government committees on information technology initiatives.

The willingness of employees to report the use of unlicensed software should be welcomed by the channel, providing them with opportunities to advise firms that want to stay on the right side of the law.

Research from the BSA revealed that more than a third of Europe’s SME employees would report illegal software use, with UK staff some of the most contientious.

Those trying to protect the software industry have been encouraging whistleblowing for quite some time and it seems that the message has got through, although most quizzed by the BSA revealed they would want a reward for reporting an issue.

The BSA has a long track record of settling with businesses that have been found to have used illegal software and have settled with the organisation to prevent the case going through the courts.

From a channel perspective not only does the pressure to be legal benefit the legitimate software reseller channel and the ISV community but it also provides opportunities for more consultancy around software asset management.

“These figures spell good news for the channel. The data shows that more than a third (34%) of Europe’s SME employees would report illegal or unethical IT practices in their workplace so businesses need to be quick to ensure they are fully compliant. Effective software and IT asset management should be the first line of defence for businesses in safeguarding against unlicensed software and, as always, this is where resellers can really help,” said Sarah Coombes, managing director compliance and enforcement at BSA EMEA.

“Of course, the channel can help businesses purchase legitimate software, however there’s also an opportunity to provide consultation and regular support on becoming and staying compliant,” she added.

Getting involved with a customer on the software management front can also lead to discussions about other areas of the business and hand the channel the chance to get a deeper relationship with clients.

“[The channel] can also provide support in other related areas of the business lifecycle such as cyber threat resilience and data regulation compliance. This is all particularly timely given that the new ISO ITAM standard (19770-1) has just been published and could be well used as a blueprint for the development of a robust IT management system,” said Coombes.

Four people have been arrested in the UK following an investigation into scams involving calls from fraudsters pretending to be IT support staff.

It follows two years of work by City of London Police and Microsoft, who teamed up to tackle the problem.

The perpetrators commonly pretend to be phoning on behalf of the US company.

The inquiry indicated that many of the calls originated in India but two men and two women in England have been accused of involvement.

They include a 29-year-old man and a 31-year-old woman from Woking in Surrey, who were arrested on suspicion of fraud. Both have been bailed.

A 37-year-old man and a 35-year-old woman were arrested in South Shields, Tyneside, on suspicion of fraud. Both were released pending further inquiries.

ANTI-SOFTWARE PIRACY group the Federation Against Software Theft (FAST) plans to step up its campaign against the use of unlicensed software by demanding money for what it calls “historic illegal use”.

The organisation, no doubt with one eye on the impact of cloud computing on its nice little earner, claimed that it has historically focused on educating companies about software use.

The audits it has conducted, meanwhile, have focused more on ‘accidental’ licence misuse, but FAST explained that companies are getting cheekier.

“In recent years there has been a very clear move by the global software industry to take a new approach to address the growing issue of unintentional piracy as a result of unpaid licences in business,” said Alex Hilton, CEO of FAST.

“But as we have seen there is still a huge number of determined individuals trying to avoid the costs of correctly licensed software. As a result, we have announced that FAST will no longer act to just recoup the losses suffered by our members and will also recover money for historic illegal use.

“That means we will no longer go after infringers solely for the cost of new software licences. We will now act retrospectively and that means a far greater financial impact.

“We’ve heard of examples where junior IT staff are forced to mislead vendors or auditors only to later become the whistleblowers. This is nothing short of a fraudulent management mindset and we are determined to stamp out intentional software misuse.”

FAST general counsel Julian Heathcote Hobbins promised to deploy FAST’s “traditional tools, such as civil lawsuits” to teach the software pirates a lesson they won’t forget.

The group will also pass the details to national law enforcement agencies, which always like some easy cases to help them reach their targets, to consider for criminal prosecution.

FAST claimed in a recent report that the commercial value of unlicensed software in the UK is the second highest in Europe with a piracy rate of 22 per cent.