The Mechanics of Sanctions Evasion: A Structural Decomposition of Transnational Technology Procurement Networks

The arrest of Jamshid Ghomi, a dual United States-Iranian national and CEO of Tehran-based Faraz Pardaz Rayaneh Co. Ltd. (FPR), exposes the structural architecture utilized by adversarial states to bypass Western export control regimes. The federal criminal complaint filed in the Central District of California charges Ghomi with conspiracy to violate the International Emergency Economic Powers Act (IEEPA). The case highlights a systemic vulnerability in global technology supply chains: the asymmetric ease with which standardized, commercial off-the-shelf (COTS) networking and encryption equipment can be weaponized for strategic military and nuclear applications.

Rather than an isolated breach, this ten-year operation demonstrates a highly systematic approach to illicit procurement. It relies on structural gaps in secondary marketplaces, regional logistics hubs, and financial reporting systems. Deconstructing this specific framework reveals the precise mechanics of technology diversion, the operational bottlenecks of export enforcement, and the strategic risk mitigation protocols required by modern hardware vendors.

The Tri-Tiered Architecture of Illicit Procurement

Transnational sanctions evasion networks do not operate via chaotic smuggling routes; they rely on a highly structured, tri-tiered supply chain designed to decouple the origin of the product from its ultimate destination.

+---------------------------------+
|      Tier 1: Sourcing Core      |
|  (US Platforms & Direct OEM)    |
+---------------------------------+
                |
                v  Disguised Consignee / Fragile Trail
+---------------------------------+
|  Tier 2: Transshipment Layer    |
|   (UAE Fronts / Free Zones)     |
+---------------------------------+
                |
                v  Re-Manifestation / Invoice Stripping
+---------------------------------+
|   Tier 3: End-User Absorption   |
|   (State Military & Nuclear)    |
+---------------------------------+

Tier 1: Sourcing and Fragmented Procurement

The first layer requires acquiring regulated technology inside the domestic market of the target state. Between 2011 and 2015, the operation exploited consumer-facing, high-liquidity digital platforms—specifically eBay and PayPal—to execute more than 400 discrete transactions. By keeping individual transaction volumes low, the network bypassed the automated compliance triggers that typically flag enterprise-level bulk corporate orders.

As the procurement needs scale, the acquisition strategy shifts from fragmented secondary markets to direct commercial procurement. In 2023, the operation advanced to direct negotiations with industrial hardware suppliers in Minnesota and Nebraska. This transition shows that as an evasion network matures, it must establish direct commercial relationships. It masks these actions by using false end-user certificates and front companies that mimic legitimate enterprise buyers.

Tier 2: The Transshipment and Logistics Layer

Direct shipping from a United States vendor to an Iranian entity triggers immediate blocks under the Iranian Transactions and Sanctions Regulations (ITSR), administered by the Office of Foreign Assets Control (OFAC). To bypass this, the network introduced a transshipment node within a highly connected logistics hub: Dubai, United Arab Emirates (UAE).

Between 2014 and 2018, the network routed more than 250 metric tonnes of networking and encryption hardware through freight forwarders in the UAE. This step uses a two-stage logistics process:

1. Primary Leg (US to UAE): The hardware is shipped to a UAE-registered corporate entity. The shipping documentation lists this entity as the final destination, which satisfies domestic US export compliance.
2. Secondary Leg (UAE to Iran): Once the cargo enters the UAE free-trade zones, the freight forwarders change the manifest. They remove the original invoices and repackage the items. They also strip the primary buyer's name from the documentation. The hardware is then re-exported across the Persian Gulf to Iran.

Tier 3: End-User Absorption

The final layer involves integrating the acquired technology into the destination state's critical infrastructure. Faraz Pardaz Rayaneh (FPR) operated as a major commercial enterprise in Tehran, generating annual revenues over $10 million and serving hundreds of domestic customers.

While the bulk of its business served commercial entities, its core strategic function was supplying specialized equipment to sanctioned state institutions. Court filings show that between 2014 and 2022, FPR held direct contracts with the Iranian Ministry of Defense and Armed Forces Logistics (specifically via Iran Computer Industries). Furthermore, from 2017 through 2023, the company acted as an approved vendor for the Atomic Energy Organization of Iran (AEOI), the state agency managing the country's nuclear development and uranium enrichment programs.

---

Financial Decoupling and the Asymmetric Audit Disconnect

An evasion network's longevity depends on its ability to move capital across borders without triggering anti-money laundering (AML) alerts. The financial mechanics of this operation reveal a stark disconnect between physical capital accumulation and formal tax reporting, creating an asymmetric signature that evaded detection for over a decade.

+------------------------------------------------------------+
|                  FINANCIAL DECOUPLING TRADEOFF             |
+------------------------------------------------------------+
| Operational Reality:                                       |
| - $15M+ transferred from Iran to US bank accounts          |
| - Funded a $35M luxury mansion in Newport Coast, CA       |
+------------------------------------------------------------+
|                          VS                                |
+------------------------------------------------------------+
| Formal Reporting Profile:                                  |
| - Highest reported annual tax income: $20,684              |
| - Claimed Earned Income Tax Credit (EITC) for 7 years      |
+------------------------------------------------------------+

Between 2011 and 2024, the network moved more than $15 million from Iranian entities into United States financial institutions. This capital flight was achieved by routing funds through third-party exchange houses (hawala networks) and non-sanctioned intermediary banks in the Gulf region. This process successfully obscured the funds' origin from a sanctioned state bank. The cleared capital was then used to buy a $35 million luxury residential estate in Newport Coast, California.

The vulnerability in this strategy lay in the massive disconnect between the individual’s physical lifestyle and their official tax filings. Internal Revenue Service Criminal Investigation (IRS-CI) records show that the individual reported a peak annual income of just $20,684 and claimed the Earned Income Tax Credit (EITC) across seven separate tax years.

This extreme imbalance underscores a major structural gap in current financial surveillance. While banking systems use sophisticated algorithms to flag unusual corporate wires, they often fail to connect domestic asset ownership (like luxury real estate) with international trade volumes and personal tax filings in real time. The network exploited this gap by operating its high-volume physical supply chain separately from its domestic financial profile.

---

The Strategic Importance of Dual-Use Commercial Off-the-Shelf Hardware

A common misconception is that state-sponsored illicit procurement networks focus primarily on specialized, military-grade hardware. In reality, the modern industrial and defense apparatus relies heavily on standard commercial off-the-shelf (COTS) networking systems.

+-----------------------------------------------------------------+
|               COTS HARDWARE IN DEFENSE STRUCTURES               |
+-----------------------------------------------------------------+
|   Commercial Layer                Military & Nuclear Application |
+-----------------------------------------------------------------+
| - Standard Enterprise Routers  -> Secure Command & Control Nodes|
| - Hardware Firewalls          -> Hardening Centrifuge Facilities|
| - Commercial Encryption Blades -> Tactical Comms Encapsulation  |
+-----------------------------------------------------------------+

Enterprise-grade routers, high-throughput switches, and hardware-based encryption modules are not inherently weaponized. However, they form the foundational infrastructure for critical state functions. A secure nuclear enrichment facility requires the same high-availability data routing, low-latency switching, and robust firewall protection as a commercial data center.

By obtaining advanced Western networking hardware, adversarial states can secure their command-and-control networks against cyber-interdiction and electronic warfare. Because these components are sold globally in high volumes, they are difficult to track. This makes them ideal for evasion networks, as they lack the strict end-to-end tracing applied to specialized munitions or nuclear-grade materials.

---

Technical Vulnerabilities in Current Export Control Enforcement

The decade-long operation of this network points to systemic weaknesses in how global export controls are enforced. The International Emergency Economic Powers Act (IEEPA) gives the Executive Branch broad power to regulate international commerce during national security crises. However, the operational execution of these regulations faces three major structural bottlenecks:

1. The Post-Sale Visibility Void

Hardware original equipment manufacturers (OEMs) possess strong visibility during the initial sales cycle. They enforce strict Know-Your-Customer (KYC) checks at the point of sale. However, once a product passes to an authorized distributor, a reseller, or an open-market platform like eBay, the OEM loses visibility into the supply chain.

Current regulatory frameworks lack an effective mechanism to track hardware ownership across secondary and tertiary markets. This allows intermediaries to acquire authentic components and divert them without alerting the original manufacturer.

2. The Limits of Fictionalized End-User Verification

Export enforcement relies heavily on automated screenings against global restricted-party lists, such as the Bureau of Industry and Security’s (BIS) Entity List. Procurement networks easily bypass these checks by setting up new front companies with generic names and clean operational histories.

Unless an enforcement agency performs physical, on-site end-user verification in foreign jurisdictions—a process limited by geopolitics and resource constraints—the validity of a corporate entity in a transshipment hub remains a significant vulnerability.

3. Falsified Customs Manifests and Bulk Cargo Blending

In high-volume shipping hubs like Dubai's Jebel Ali Free Zone, customs authorities handle millions of twenty-foot equivalent units (TEUs) annually. Evasion networks exploit this massive volume by practicing bulk cargo blending.

By packing controlled enterprise electronics deep inside larger shipments of unregulated consumer goods, and using false descriptions on the bill of lading, these networks make physical detection highly unlikely without specific, intelligence-driven tips.

---

Corporate Mitigation Frameworks for Hardware Vendors

To avoid regulatory penalties and protect their technology from illicit diversion, hardware manufacturers and enterprise technology vendors must shift from reactive compliance to proactive, data-driven supply chain verification. Relying solely on basic database checks at the point of sale is no longer sufficient.

+-----------------------------------------------------------------+
|             PROACTIVE CORPORATE MITIGATION BLUEPRINT            |
+-----------------------------------------------------------------+
| [1. Digital Fingerprinting] -> Bind software licenses to unique |
|                                physical silicon signatures.     |
|                                                                 |
| [2. Anomalous Licensing]    -> Flag hardware operating outside  |
|                                authorized geographic IPs.        |
|                                                                 |
| [3. High-Risk Node Auditing]-> Restrict distribution channels   |
|                                in known transshipment hubs.     |
+-----------------------------------------------------------------+

Implement Hardware-to-Software Cryptographic Binding

Manufacturers should design hardware platforms where the physical silicon signature is cryptographically bound to a dynamic software license. If a device is moved or lacks a validated, location-aware license key signed by the OEM, it should automatically restrict its advanced capabilities or disable its encryption modules. This shifts enforcement from the physical shipping stage to the operational stage.

Deploy Automated Anomalous Activation Alerts

Enterprise technology vendors must actively monitor where their software updates and firmware patches are downloaded. If a hardware asset originally sold to an entity in a neutral country attempts to connect to update servers from IP pools linked to restricted regions—or routes through known commercial proxy servers—the system should immediately flag the device for an audit and pause further updates.

Conduct Advanced Audits on Intermediary Distribution Channels

Technology firms must enforce stricter compliance requirements down the supply chain. Distributors operating near known transshipment hubs must face mandatory, independent audits of their end-user documentation. Contracts must include clawback clauses and immediate termination provisions for any partner that fails to verify the final destination of high-capacity networking or encryption products.