DOJ's First "Near Miss" NPA: What Extreme Networks Shows About Self-Disclosure Timing

On October 27, DOJ’s National Security Division announced a non-prosecution agreement with Extreme Networks over networking equipment and services that ended up with a Russian air-defense manufacturer owned by Almaz-Antey, which has been on OFAC’s SDN list since 2014. The company self-disclosed, cooperated fully, and remediated. It still got a criminal resolution because DOJ found the disclosure came too late. If you run an export control compliance program, the case is mostly a lesson about what happens between when you first learn about the potential violation and when you notify the government.

The short answer

DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy has a middle tier for companies that cooperate and remediate but don’t fully qualify for a declination. Extreme Networks is the Department’s first NPA under that tier. The company paid about $976,000 to the DOJ (a fine plus forfeiture of the same amount), and the NPA notes a separate OFAC penalty of about $1.53 million.

The reason for the non-declination was that the company waited too long to tell the government. A whistleblower raised the issue in April 2022. The company ran an internal investigation in consultation with outside counsel. About six months after the report, in October 2022, it disclosed to DOJ, only after a journalist contacted it with new facts, and the disclosure landed days before the article ran. DOJ’s view was that a disclosure made under imminent threat of publication isn’t voluntary in the sense the policy requires.

For a company facing a credible allegation of a willful export or sanctions violation, the disclosure question must be addressed in parallel with the internal investigation, starting from the first credible report.

How the policy works

The policy, linked from the DOJ press release, applies to all corporate criminal matters at the DOJ except antitrust matters. There are three possible outcomes.

Appendix B of the policy defines a voluntary self-disclosure. All five elements have to be present: a good-faith disclosure to the right DOJ component, of misconduct DOJ didn’t already know about, with no preexisting obligation to disclose, made before an imminent threat of disclosure or government investigation, and made “within a reasonably prompt time” after the company became aware of it. The company carries the burden of showing timeliness.

Appendix B also has a whistleblower provision. If an employee reports internally and also goes to DOJ, the company can still qualify for a declination if it self-reports “as soon as reasonably practicable but no later than 120 days” after the internal report.

The Extreme Networks NPA is explicit about which element failed: the company disclosed because a news story was about to run, not before DOJ was likely to learn of the conduct some other way. DOJ found no aggravating circumstances. Cooperation received full credit: rolling production of nearly 400,000 documents, interviews with current and former employees, including foreign-based ones, and an agreement to toll the statute of limitations.

What actually happened inside the company

The Statement of Facts attached to the NPA describes a small Moscow sales office that Extreme acquired out of another company’s bankruptcy. Extreme sold in Russia through distributors and resellers. The orders at issue were booked to a Russian company that the air-defense manufacturer “used to acquire products and services,” and the NPA notes little evidence that the intermediary ran a real business of its own. A manufacturer employee was the named representative on those purchases. According to the DOJ, a small group of Russia-based employees concealed the real end user from the company’s global trade compliance group, leading to false export filings.

The facts describe employees hiding the end user from compliance through an intermediary. A better screening product would not have changed much on those facts, although the remediation list does include a new screening tool and daily rescreening.

Where companies get this wrong

Treating the internal investigation as a pause button

The most common instinct after a credible whistleblower report is to finish the investigation, understand the full scope, and then decide whether to disclose. That’s defensible as a way to avoid disclosing something that turns out to be nothing. The trouble is that the policy measures timeliness from when the company became aware of the misconduct, and it puts the burden on the company. In this case, about six months passed between the whistleblower report and the disclosure, and DOJ treated the disclosure as prompted by the reporter’s call rather than by the investigation.

I’d rather make an initial disclosure once there’s a credible basis, describe it as preliminary, and supplement as the investigation develops. DOJ’s own cooperation credit assumes facts will keep coming in after the first contact.

Assuming a BIS or OFAC disclosure covers DOJ

Export compliance teams are used to filing voluntary self-disclosures with BIS under 15 CFR 764.5, with OFAC under its enforcement guidelines (31 CFR Part 501, App. A), or with DDTC under 22 CFR 127.12. Footnote 5 of the DOJ policy states that disclosures made only to regulatory or civil enforcement agencies generally don’t qualify as voluntary self-disclosure to the DOJ. They may count toward cooperation and remediation, and the policy leaves room for exceptions, but a company that believes it may have a willful violation should decide deliberately whether DOJ also needs to hear from it, rather than assume the regulator will pass it along.

Forgetting what you inherited

The Moscow office came with an acquisition, along with employees who already knew the customer. The remediation list in the NPA includes new M&A diligence procedures, which indicate that the DOJ saw the acquisition as part of how the problem started.

Relying on screening to catch concealment

Restricted-party screening checks the parties named on the order. If the people booking the order route it through an intermediary, the screen won’t flag it. The controls that would have helped here sit elsewhere: end-use and end-user questions for sensitive sectors, attention to a reseller whose orders don’t match its business, and a way for compliance to hear when a sales rep’s former employer was the sanctioned party.

What to do this quarter

The remediation Extreme agreed to is a decent starting list, and so is the timeline that cost it the declination. These are the items I’d check first:

• Make sure your hotline and investigation procedures say that a disclosure decision is made in parallel with the investigation, not at the end of it.
• Add a step to your disclosure analysis that asks whether DOJ needs a separate disclosure, not just BIS, OFAC, or DDTC.
• Track the 120-day mark from any internal whistleblower report on a possible export or sanctions violation, since the reporter may go to the DOJ too.
• Have a plan for a media inquiry that touches a compliance issue, including who gets told and how fast, because a reporter’s call can end your chance at a declination.
• Add trade-compliance questions to acquisition diligence for any target with sales offices or distributors in high-risk jurisdictions, and repeat the review after closing.
• For distributors and resellers in sensitive markets, require end-user information on orders for listed product categories, and check orders that don’t fit the reseller’s normal business.
• Rescreen your customer and end-user data on a schedule (Extreme moved to daily) and require a documented reason to release any hold.

The full NPA, including the Statement of Facts, is linked from the DOJ press release. It’s worth reading paragraph 2, where DOJ explains how it weighed the disclosure, cooperation, and remediation.