How a US firm supplied networking technology to maker of feared…

Extreme Networks says Reuters discovery leads it to believe its products were shipped to «bad actors» in Russia

*

Extreme Networks says it is informing U.S.authorities of export-control violation

*

Extreme Networks says distributor played role in «scheme»

*

Extreme Networks supplied equipment used in MMZ Avangard’s office IT systems

*

MMZ Avangard is maker of missile used in recent Ukraine attack

By Aram Roston and David Gauthier-Villars

WASHINGTON, Oct 12 (Reuters) — Since Russia annexed Crimea in 2014, American companies have been prohibited from dealing with MMZ Avangard, a state-owned firm that makes missiles for one of Russia’s most sophisticated weapons, the S-400 air-defense system.

In a measure of Western concern about the S-400, the United States ejected Turkey, a NATO member, from a joint fighter jet program in 2019 after Ankara took delivery of the Russian system.

But even as the United States was taking actions to blunt MMZ Avangard’s business, a publicly traded American technology company, Extreme Networks, was providing MMZ Avangard with computer networking equipment for its office IT systems, according to emails and other business records seen by Reuters, as well as interviews with people familiar with the matter.

In a statement to Reuters, Extreme said that based on information provided by the news agency it believed equipment «may have» been sold to MMZ Avangard using a surrogate buyer.

Extreme said the equipment was sold without its knowledge. It added, without providing evidence, that an intermediary in Russia was «complicit» in supplying its products via a front company to «bad actors.» Extreme said it is reporting its findings of these potential sales to U.S.

authorities.

Ukraine has accused Russia of deploying missiles made by MMZ Avangard against ground targets since Russia launched what it terms its «special operation» on Feb. 24. Ukrainian authorities said MMZ Avangard missiles killed at least thirty civilians in a gruesome attack against a convoy on the edge of the southern city of Zaporizhzhia last month.Neither Kremlin officials nor MMZ Avangard responded to questions for this article. MMZ Avangard’s parent, Almaz-Antey, also didn’t comment.

Between 2017 and 2021, MMZ Avangard obtained over half a million dollars’ worth of Extreme equipment for its IT systems, according to the business records reviewed by Reuters and the people familiar with the matter.The products included high-speed switches, an essential building block of corporate IT networks, and software.

The records also show that the deals went through a seemingly innocuous corporation near Moscow, and despite two Extreme officials raising concerns, the sales went forward.

That a Russian military company, identified as a threat by Washington, continued to acquire U.S.computer hardware is a case study in how Western countries may have overestimated their ability to choke the Russian economy with export bans and trade sanctions. It also highlights how dependent Russia’s military machine is on U.S. high-tech equipment.

In April, six weeks after Russia’s invasion of Ukraine, an Extreme employee filed an internal complaint, seen by Reuters, alleging that the company was selling to various military manufacturers in Russia.»Extreme equipment is used on Russian warships,» the complaint said, «in communications systems.»

Extreme said in its statement that the allegations were brought by a disgruntled employee. An investigation by the firm had found nothing to corroborate any of the claims until Reuters brought «new facts» to the company’s attention this month.The company said it ceased operations in Russia in March, adding that it subsequently launched a process to dismiss the disgruntled employee for poor performance. It said it has no records of sales involving Russian warships.

Extreme, which trades on the NASDAQ exchange and is headquartered in Morrisville, North Carolina, has earned a solid reputation in the United States and is an official partner of the National Football League.The NFL declined to comment for this article.

A Reuters investigation in August found that while the United States and allies banned high-tech exports to Russia to try to cripple its defense industry, and many tech companies announced that they had halted exports to Russia, the flow of Western brand-name computer parts to Russian clients hasn’t stopped.

This account of how Extreme supplied MMZ Avangard and at least two other Russian military companies is based on interviews with three people familiar with the shipments as well as a review by Reuters of documents spanning five years to 2021.The documents include sales records and email exchanges between Extreme employees, customers and distributors. The shipments are reported here for the first time.

The U.S. Department of Commerce, which administers export restrictions, declined to comment for this story.

«IT WAS NECESSARY TO USE COVER»

Russian companies, including those in the military sector, have virtually no choice but to buy foreign equipment to build the computer networks necessary for modern-day business.Russia has very limited domestic production of networking equipment.

Founded in 1996, Extreme is a junior player in the computer networking industry. Last year, it posted revenue of $1.1 billion, compared with $50 billion for Cisco Systems.

Still, the smaller company is a «meaningful competitor,» according to Alex Henderson, a network and security analyst at Needham and Company in New York.The U.S. military as well as NASA use Extreme hardware and support, according to contracting records, and the company has built up a substantial marketing profile.

In Russia, as well, Extreme lists prestigious customers, such as the Ministry of Health, the federal pension fund and Lomonosov Moscow State University.

But according to documents seen by Reuters, other buyers of Extreme equipment included not just MMZ Avangard but a major Russian military shipbuilding company and a high-tech defense electronics manufacturer.

One of the documents shows that in the four years ending 2020, Russian customers purchased $41.5 million worth of equipment.Reuters couldn’t determine Extreme’s total sales to sanctioned or military firms because it wasn’t clear if transactions other than those involving MMZ Avangard had been recorded under cover names.

In its statement to Reuters, Extreme said it doesn’t report country specific revenue.

In Russia, Extreme maintained contacts with its customers in order to help design complex networks that expand over time, according to two of the people familiar with the matter.Each customer or potential buyer had its own account manager at the company and was listed on internal sales records. Actual sales, though, were done through authorized intermediaries.

Extreme, in its statement to Reuters, said it rarely provided direct installation services.It said it had no such contracts with DEMZ or MMZ Avangard.

In its statement, Extreme said it has a «firm policy» not to work with sanctioned entities, but added it isn’t always notified of the end customer, especially when its products are sold through so-called «stocking» distributors that hold an inventory.

Extreme named one of those distributors as RRC and said it believed RRC was «complicit» in the scheme to supply MMZ Avangard.RRC and its Cyprus parent, BD Enterprise Networking didn’t respond to messages from Reuters seeking comment.

For Russian military companies, Extreme equipment had a strong selling point, the three people familiar with the shipments said: Unlike larger rivals, Extreme doesn’t require service subscriptions and frequent software updates.»It is absolutely autonomous,» one of the people said of the equipment. «It works without a license and you don’t even need to be connected to the internet.» This means, another person said, that «you don’t need to fear that your system will go dark because someone in the U.S. decided to disconnect you.»

Extreme said that the «autonomous model» is not unique to the company, but acknowledged it has become relatively rare.

It was no secret in Russia that MMZ Avangard used Extreme equipment.In late 2019, the missile manufacturer issued a tender through Russia’s online public procurement platform, saying it needed spare parts for the Extreme computer networks it possessed. Extreme didn’t dispute this but said it wouldn’t necessarily be aware of such a tender.

A few months before, in the summer of 2019, an intermediary had contacted Extreme’s representative office in Russia, asking for advice on a network upgrade for the missile company, the documents show.»We are working on a solution for the customer, MMZ Avangard,» an employee of the intermediary wrote in a June 28, 2019, email to an Extreme system engineer. «I was told that I could seek your help.»

As soon as its equipment arrived in Moscow, Extreme dispatched a staff engineer to MMZ Avangard’s offices to help ensure a smooth installation, one of the people familiar with the shipments said.

In its statement to Reuters, Extreme said it had no records of an Extreme employee installing equipment at MMZ Avangard.

When it came to processing MMZ Avangard’s purchasing orders, the missile maker’s name didn’t appear on Extreme’s books.Instead, Extreme’s Moscow employees recorded the orders as having been placed by a company called OOO DEMZ, according to emails and sales records, as well as three people familiar with the matter.

«It was necessary to use a cover because the Russian company is blacklisted in the U.S.,» one of the people familiar with the shipments said.It has been illegal for U.S. companies to do business with MMZ Avangard since July 2014, when the U.S. Treasury Department listed its parent company, Almaz-Antey, as a «blocked» entity. The Treasury declined to comment for this story.

MMZ Avangard began buying products from Extreme in December 2017 and was disguised under the DEMZ cover in Extreme business records from that date, according to emails and other documents seen by Reuters.The most recent transaction using the DEMZ cover that Reuters identified was in September 2021. In total, the records show that Extreme shipped goods worth about $645,000 in this way during that period.

Extreme, in its statement, said it now believes that its equipment may have been acquired through a «front company.» Extreme confirmed that the DEMZ account listed product purchases for approximately $645,000.

DEMZ is a small company based in Dmitrov, a city 50 miles north of Moscow.Russian corporate records list Vladimir Markov as its general director. Reached by phone, Markov said that DEMZ, which made tools for railcar maintenance, ceased all operations in 2016. The executive said he had never heard of Extreme or of DEMZ buying Extreme equipment for itself or on behalf of others.

The apparent ruse was a shallow one.

Purported executives for DEMZ, listed in the Extreme customer records seen by Reuters, were actually employees of the missile maker who had provided their MMZ Avangard email addresses. They even included the Avangard email addresses when they applied for access to an Extreme customer service portal.

One of these people declined to comment. The other couldn’t be reached. Some of the documents also listed mmza.ru — MMZ Avangard’s domain name — as DEMZ’s purported web address.

On the last day of 2019, as a «DEMZ» order was winding through Extreme’s approval system, an Extreme sales manager working in North Carolina emailed RRC, the Russian distributor, with a question about the domain name: «Can you tell me what the relationship is between DEMZ and mmza.ru?» An employee of the distributor responded that mmza.ru was «the customer’s» domain. The employee didn’t elaborate.A subsequent message indicates that the sale went through.

Extreme, in its statement, did not address questions about MMZ Avangard staff registering for access to online support, and an Extreme sales manager raising questions about the web domain.

Nearly a year later, dealing with another set of «DEMZ» orders, an employee from Extreme’s in-house compliance desk in Ireland spotted the mmza.ru domain in the sales paperwork and researched it.»This link,» the compliance team employee said in a Nov. 11, 2020, email, «goes directly to website which is a defense contractor seemingly to specialize in ground to air missile systems, we need to further review before we can make a decision.»

Extreme, in its statement, also did not address questions about this email.

«GOOD NEWS»

The Extreme compliance employee instructed the Russia office to have «DEMZ,» the purported customer, fill out a form to certify there was no military end-user, that the equipment would not be resold for any military purpose, and that it would not be transferred to any sanctioned company.

Less than a week after the message from the Extreme compliance employee, a two-page letter seen by Reuters attested that the end-user was not sanctioned, and would not use Extreme’s equipment in a way banned by U.S.law. Bearing an illegible signature and a blue «DEMZ» stamp, the document was sent to Extreme’s compliance desk, according to one of the people familiar with the matter.

DEMZ’s business, according to the purported self-declaration, had nothing to do with sophisticated missiles.Rather it was «components for the Metalworking of country houses.» DEMZ never made such components and was out of business at the time of the letter, according to former director general Markov.

«Just heard back from our supply team for the DEMZ orders,» emailed the North Carolina manager on Nov.25 «with some good news.»

The sales could go through.

«Thank you,» Extreme’s Vienna-based regional director for Northern and Eastern Europe wrote.

U.S.

export control specialists told Reuters self-declarations can be useful in determining whether a client is legitimate. However, upon coming across a red flag, «you stop or put on hold the transaction,» said James Fuller, a former special agent with the U.S. Department of Commerce.

«You don’t offer an avenue to provide more false information, or suggest some kind of workaround.»

Extreme in its statement to Reuters confirmed that its internal compliance officer had requested and received the self-declaration. The company added that it has «other screening processes to check for red flags.»

SHIPBUILDING

In Russia, Extreme supplied IT equipment to other military companies, according to the business documents seen by Reuters and the people familiar with the matter.

One of them was United Shipbuilding Corp.The company has headquarters in St. Petersburg and operates a host of Russian shipyards, making everything from frigates to submarines to mine sweepers. Like MMZ Avangard, United Shipbuilding has been listed as a «blocked» entity by the U.S. Treasury since July 2014.

Another one was Concern Morinformsystem-Agat, a manufacturer of radar and other military electronics systems.According to the documents, including a July 2020 public tender, and one of the people familiar with the matter, Agat was relying on equipment from Extreme for some of its systems, which were then fitted on United Shipbuilding warships.

Extreme told Reuters it had no records of selling products to United Shipbuilding or Agat.The Russian companies did not respond to requests for comment.

United Shipbuilding is clearly described as an Extreme customer in email correspondence. In April 2020, an intermediary contacted Extreme’s office in Moscow to submit the plan the intermediary had sketched out to modernize United Shipbuilding’s data center.

A Russia-based engineer from Extreme responded the next day, pointing to a few items that could be removed from the proposed design.

«Apart from that, it’s all correct,» the Extreme engineer wrote in the email.

(additional reporting by Maurice Tamman in New York)