Classic 'two steps removed' syndrome.
"I told X to get it done. What X did to get it done is not my fault/responsibility."
"I told X to get it done. What X did to get it done is not my fault/responsibility."
If you tell X to get something done and ALSO give X rules that they must follow and X gets the thing done but __breaks the rules__ then this is different. It is also different if you have reasonable suspicion to expect them to break the rules or are using subversive language to tell them to break the rules. These are different things and have different consequences.
If you are truely acting in good faith, then yes, it is a defense. But determining if that's true is not an easy task.
There is good faith, coercion, negligence, and willful negligence. These are different things.
This is the iterated game that morally bankrupt manufacturers (IE the vast majority) play to insulate themselves in these sort of scandals: - First, they get caught doing A,B,C, so they pass rules about A,B,C - Then they outsource to someone who is willing to do A,B,C, then they get caught outsourcing to violators - Then, they impose rules about A,B,C on these firms, but do no verification of the firms adherence to those rules. It insulates them of liability without ever increasing costs (because the firms still get to break the rules and the company gets to say "I'm Shocked! I told you not to do that!")
The verification process is exceptionally difficult. We're on HN and I think it should be rather common knowledge that attackers almost always beat defenders because the game is asymmetric. Attackers only need to find a single flaw while defenders need to find a large number of defenses. There is a huge difference in the resource expenditures between these two groups. This is related to the reasons why one single person can fuck shit up (e.g. a bad driver can impact tens of thousands of other drivers) but it is difficult for a single person to fix things. It is the nature of unstable equilibria.
A society, of any form, depends on trust. Like it or not, there are no trustless systems available to us. Certainly not at any meaningful scale.
This does not mean one should be negligent, but rather I'm saying that it isn't easy and the best intentioned can still be taken advantage of. We should recognize this and accommodate this fact when approaching solutions or we will end up with many undesired results.
If I can't trust the bank to know more about the UBO of some rando after KYC what the hell are we doing this for?
A good outcome of this would be more restrictions on outsourcing to China since it’s been repeatedly shown that they will not maintain meaningful restrictions on North Korea, Russia, Iran, etc.:
> All three cities are known to have many North Korean-operated businesses and are main centers for North Korea’s IT workers who live overseas.
Or is it the faith of hackers that any misdoing in the world should always be traced back and blamed on a tech giant? From the article:
"There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators."
If it's a subsidiary, that's another case.
So why is it different if they sell me floor tiles made with slave labor?
Global retailers like H&M and IKEA do do audits of their supply chain to try to stop labor abuse (although how effective they are at that is up to debate)
But if you unknowingly buy floor tiles that have been made with unethical practices, should you be held responsible as a customer? Of course not.