Special Report: How a US firm supplied networking technology to maker of feared Russian missiles

Extreme Networks

12/10/2022 15:41

(publishes to additional subscribers)

        * 
      Extreme Networks says Reuters discovery leads it to
believe its
products were shipped to "bad actors" in Russia 
    

        * 
      Extreme Networks says it is informing U.S. authorities of
export-control violation
    

        * 
      Extreme Networks says distributor played role in "scheme"
    

        * 
      Extreme Networks supplied equipment used in MMZ Avangard's
office IT systems
    

        * 
      MMZ Avangard is maker of missile used in recent Ukraine
attack
    

  
    By Aram Roston and David Gauthier-Villars
       WASHINGTON, Oct 12 (Reuters) - Since Russia annexed
Crimea in 2014, American companies have been prohibited from
dealing with MMZ Avangard, a state-owned firm that makes
missiles for one of Russia's most sophisticated weapons, the
S-400 air-defense system.
    In a measure of Western concern about the S-400, the United
States ejected Turkey, a NATO member, from a joint fighter jet
program in 2019 after Ankara took delivery of the Russian
system.
    But even as the United States was taking actions to blunt
MMZ Avangard's business, a publicly traded American technology
company, Extreme Networks  EXTR.O , was providing MMZ Avangard
with computer networking equipment for its office IT systems,
according to emails and other business records seen by Reuters,
as well as interviews with people familiar with the matter.
    In a statement to Reuters, Extreme said that based on
information provided by the news agency it believed equipment
"may have" been sold to MMZ Avangard using a surrogate buyer.
Extreme said the equipment was sold without its knowledge. It
added, without providing evidence, that an intermediary in
Russia was "complicit" in supplying its products via a front
company to "bad actors." Extreme said it is reporting its
findings of these potential sales to U.S. authorities.
    Ukraine has accused Russia of deploying missiles made by MMZ
Avangard against ground targets since Russia launched what it
terms its "special operation" on Feb. 24. Ukrainian authorities
said MMZ Avangard missiles killed at least thirty civilians in a
gruesome attack against a convoy on the edge of the southern
city of Zaporizhzhia last month. Neither Kremlin officials nor
MMZ Avangard responded to questions for this article. MMZ
Avangard's parent, Almaz-Antey, also didn't comment.
    Between 2017 and 2021, MMZ Avangard obtained over half a
million dollars' worth of Extreme equipment for its IT systems,
according to the business records reviewed by Reuters and the
people familiar with the matter. The products included
high-speed switches, an essential building block of corporate IT
networks, and software.
    The records also show that the deals went through a
seemingly innocuous corporation near Moscow, and despite two
Extreme officials raising concerns, the sales went forward.
    That a Russian military company, identified as a threat by
Washington, continued to acquire U.S. computer hardware is a
case study in how Western countries may have overestimated their
ability to choke the Russian economy with export bans and trade
sanctions. It also highlights how dependent Russia's military
machine is on U.S. high-tech equipment.
    In April, six weeks after Russia's invasion of Ukraine, an
Extreme employee filed an internal complaint, seen by Reuters,
alleging that the company was selling to various military
manufacturers in Russia. "Extreme equipment is used on Russian
warships," the complaint said, "in communications systems."
    Extreme said in its statement that the allegations were
brought by a disgruntled employee. An investigation by the firm
had found nothing to corroborate any of the claims until Reuters
brought "new facts" to the company's attention this month. The
company said it ceased operations in Russia in March, adding
that it subsequently launched a process to dismiss the
disgruntled employee for poor performance. It said it has no
records of sales involving Russian warships.
    Extreme, which trades on the NASDAQ exchange and is
headquartered in Morrisville, North Carolina, has earned a solid
reputation in the United States and is an official partner of
the National Football League. The NFL declined to comment for
this article.
    A Reuters investigation in August found that while the
United States and allies banned high-tech exports to Russia to
try to cripple its defense industry, and many tech companies
announced that they had halted exports to Russia, the flow of
Western brand-name computer parts to Russian clients hasn't
stopped.
    This account of how Extreme supplied MMZ Avangard and at
least two other Russian military companies is based on
interviews with three people familiar with the shipments as well
as a review by Reuters of documents spanning five years to 2021.
The documents include sales records and email exchanges between
Extreme employees, customers and distributors. The shipments are
reported here for the first time.
    The U.S. Department of Commerce, which administers export
restrictions, declined to comment for this story.
    "IT WAS NECESSARY TO USE COVER"
    Russian companies, including those in the military sector,
have virtually no choice but to buy foreign equipment to build
the computer networks necessary for modern-day business. Russia
has very limited domestic production of networking equipment.
    Founded in 1996, Extreme is a junior player in the computer
networking industry. Last year, it posted revenue of $1.1
billion, compared with $50 billion for Cisco Systems.
    Still, the smaller company is a "meaningful competitor,"
according to Alex Henderson, a network and security analyst at
Needham and Company in New York. The U.S. military as well as
NASA use Extreme hardware and support, according to contracting
records, and the company has built up a substantial marketing
profile.
    In Russia, as well, Extreme lists prestigious customers,
such as the Ministry of Health, the federal pension fund and
Lomonosov Moscow State University.
    But according to documents seen by Reuters, other buyers of
Extreme equipment included not just MMZ Avangard but a major
Russian military shipbuilding company and a high-tech defense
electronics manufacturer.
    One of the documents shows that in the four years ending
2020, Russian customers purchased $41.5 million worth of
equipment. Reuters couldn't determine Extreme's total sales to
sanctioned or military firms because it wasn't clear if
transactions other than those involving MMZ Avangard had been
recorded under cover names.
    In its statement to Reuters, Extreme said it doesn't report
country specific revenue.
    In Russia, Extreme maintained contacts with its customers in
order to help design complex networks that expand over time,
according to two of the people familiar with the matter. Each
customer or potential buyer had its own account manager at the
company and was listed on internal sales records. Actual sales,
though, were done through authorized intermediaries.
    Extreme, in its statement to Reuters, said it rarely
provided direct installation services. It said it had no such
contracts with DEMZ or MMZ Avangard.
    In its statement, Extreme said it has a "firm policy" not to
work with sanctioned entities, but added it isn't always
notified of the end customer, especially when its products are
sold through so-called "stocking" distributors that hold an
inventory.
    Extreme named one of those distributors as RRC and said it
believed RRC was "complicit" in the scheme to supply MMZ
Avangard. RRC and its Cyprus parent, BD Enterprise Networking
didn't respond to messages from Reuters seeking comment.
    For Russian military companies, Extreme equipment had a
strong selling point, the three people familiar with the
shipments said: Unlike larger rivals, Extreme doesn't require
service subscriptions and frequent software updates. "It is
absolutely autonomous," one of the people said of the equipment.
"It works without a license and you don't even need to be
connected to the internet." This means, another person said,
that "you don't need to fear that your system will go dark
because someone in the U.S. decided to disconnect you."
    Extreme said that the "autonomous model" is not unique to
the company, but acknowledged it has become relatively rare.
    It was no secret in Russia that MMZ Avangard used Extreme
equipment. In late 2019, the missile manufacturer issued a
tender through Russia's online public procurement platform,
saying it needed spare parts for the Extreme computer networks
it possessed. Extreme didn't dispute this but said it wouldn't
necessarily be aware of such a tender.
    A few months before, in the summer of 2019, an intermediary
had contacted Extreme's representative office in Russia, asking
for advice on a network upgrade for the missile company, the
documents show. "We are working on a solution for the customer,
MMZ Avangard," an employee of the intermediary wrote in a June
28, 2019, email to an Extreme system engineer. "I was told that
I could seek your help."
    As soon as its equipment arrived in Moscow, Extreme
dispatched a staff engineer to MMZ Avangard's offices to help
ensure a smooth installation, one of the people familiar with
the shipments said.
    In its statement to Reuters, Extreme said it had no records
of an Extreme employee installing equipment at MMZ Avangard.
    When it came to processing MMZ Avangard's purchasing orders,
the missile maker's name didn't appear on Extreme's books.
Instead, Extreme's Moscow employees recorded the orders as
having been placed by a company called OOO DEMZ, according to
emails and sales records, as well as three people familiar with
the matter.
    "It was necessary to use a cover because the Russian company
is blacklisted in the U.S.," one of the people familiar with the
shipments said. It has been illegal for U.S. companies to do
business with MMZ Avangard since July 2014, when the U.S.
Treasury Department listed its parent company, Almaz-Antey, as a
"blocked" entity. The Treasury declined to comment for this
story.
    MMZ Avangard began buying products from Extreme in December
2017 and was disguised under the DEMZ cover in Extreme business
records from that date, according to emails and other documents
seen by Reuters. The most recent transaction using the DEMZ
cover that Reuters identified was in September 2021. In total,
the records show that Extreme shipped goods worth about $645,000
in this way during that period.
    Extreme, in its statement, said it now believes that its
equipment may have been acquired through a "front company."
Extreme confirmed that the DEMZ account listed product purchases
for approximately $645,000.
    DEMZ is a small company based in Dmitrov, a city 50 miles
north of Moscow. Russian corporate records list Vladimir Markov
as its general director. Reached by phone, Markov said that
DEMZ, which made tools for railcar maintenance, ceased all
operations in 2016. The executive said he had never heard of
Extreme or of DEMZ buying Extreme equipment for itself or on
behalf of others.
    The apparent ruse was a shallow one. Purported executives
for DEMZ, listed in the Extreme customer records seen by
Reuters, were actually employees of the missile maker who had
provided their MMZ Avangard email addresses. They even included
the Avangard email addresses when they applied for access to an
Extreme customer service portal. One of these people declined to
comment. The other couldn't be reached. Some of the documents
also listed mmza.ru - MMZ Avangard's domain name - as DEMZ's
purported web address.
    On the last day of 2019, as a "DEMZ" order was winding
through Extreme's approval system, an Extreme sales manager
working in North Carolina emailed RRC, the Russian distributor,
with a question about the domain name: "Can you tell me what the
relationship is between DEMZ and mmza.ru?" An employee of the
distributor responded that mmza.ru was "the customer's" domain.
The employee didn't elaborate. A subsequent message indicates
that the sale went through.
    Extreme, in its statement, did not address questions about
MMZ Avangard staff registering for access to online support, and
an Extreme sales manager raising questions about the web domain.
    Nearly a year later, dealing with another set of "DEMZ"
orders, an employee from Extreme's in-house compliance desk in
Ireland spotted the mmza.ru domain in the sales paperwork and
researched it. "This link," the compliance team employee said in
a Nov. 11, 2020, email, "goes directly to https://mmzavangard.ru/
 which is a defense contractor seemingly  sic  to specialize in
ground to air missile systems, we need to further review before
we can make a decision."
    Extreme, in its statement, also did not address questions
about this email.
    "GOOD NEWS"
    The Extreme compliance employee instructed the Russia office
to have "DEMZ," the purported customer, fill out a form to
certify there was no military end-user, that the equipment would
not be resold for any military purpose, and that it would not be
transferred to any sanctioned company.
    Less than a week after the message from the Extreme
compliance employee, a two-page letter seen by Reuters attested
that the end-user was not sanctioned, and would not use
Extreme's equipment in a way banned by U.S. law. Bearing an
illegible signature and a blue "DEMZ" stamp, the document was
sent to Extreme's compliance desk, according to one of the
people familiar with the matter.
    DEMZ's business, according to the purported
self-declaration, had nothing to do with sophisticated missiles.
Rather it was "components for the Metalworking of country
houses." DEMZ never made such components and was out of business
at the time of the letter, according to former director general
Markov.
    "Just heard back from our supply team for the DEMZ orders,"
emailed the North Carolina manager on Nov. 25 "with some good
news."
    The sales could go through.
    "Thank you," Extreme's Vienna-based regional director for
Northern and Eastern Europe wrote. 
    U.S. export control specialists told Reuters
self-declarations can be useful in determining whether a client
is legitimate. However, upon coming across a red flag, "you stop
or put on hold the transaction," said James Fuller, a former
special agent with the U.S. Department of Commerce. "You don't
offer an avenue to provide more false information, or suggest
some kind of workaround."
    Extreme in its statement to Reuters confirmed that its
internal compliance officer had requested and received the
self-declaration. The company added that it has "other screening
processes to check for red flags." 
    SHIPBUILDING
    In Russia, Extreme supplied IT equipment to other military
companies, according to the business documents seen by Reuters
and the people familiar with the matter.
    One of them was United Shipbuilding Corp. The company has
headquarters in St. Petersburg and operates a host of Russian
shipyards, making everything from frigates to submarines to mine
sweepers. Like MMZ Avangard, United Shipbuilding has been listed
as a "blocked" entity by the U.S. Treasury since July 2014.
    Another one was Concern Morinformsystem-Agat, a manufacturer
of radar and other military electronics systems. According to
the documents, including a July 2020 public tender, and one of
the people familiar with the matter, Agat was relying on
equipment from Extreme for some of its systems, which were then
fitted on United Shipbuilding warships.
    Extreme told Reuters it had no records of selling products
to United Shipbuilding or Agat. The Russian companies did not
respond to requests for comment.
    United Shipbuilding is clearly described as an Extreme
customer in email correspondence. In April 2020, an intermediary
contacted Extreme's office in Moscow to submit the plan the
intermediary had sketched out to modernize United Shipbuilding's
data center.
    A Russia-based engineer from Extreme responded the next day,
pointing to a few items that could be removed from the proposed
design.
    "Apart from that, it's all correct," the Extreme engineer
wrote in the email.
    (additional reporting by Maurice Tamman in New York)
    ((Reporting by Aram Roston in Washington and David
Gauthier-Villars in Istanbul; edited by Janet McBride))