前美国海外资产控制办公室官员敦促TrustAsia公司在为时已晚前加强合规审查
2026年9月18日 美国东部时间12:17 / 福克斯新闻
作者：艾玛·巴锡
前OFAC官员警告：中国科技企业为伊朗提供服务或面临美国制裁
律师、前美国海外资产控制办公室官员杰里米·帕纳表示，即便仅向受制裁的伊朗实体提供有限服务，也可能触发制裁行动。
NEW 你现在可以收听福克斯新闻文章！
blob:https://www.foxnews.com/fbe59cef-5285-4c74-b42a-99fd3ba803f4
收听本文
时长9分钟
全球互联网监测机构表示，伊朗受制裁的波斯湾海峡管理局（PGSA）在一家上海互联网安全公司为其提供并随后撤销网络凭证后，恢复了四天的安全在线访问能力，此举令德黑兰得以在受到美国数字限制的情况下，仍能对船只进行核查、收取霍尔木兹海峡过路费并开展运营。
TrustAsia公司发放了自动化域名验证证书，这是一项常规流程，通过服务器检查验证对网站域名的控制权，通常不涉及人工审查或背景调查。
此举促使包括休斯·哈伯德·里德律师事务所合伙人杰里米·帕纳在内的美国制裁专家敦促TrustAsia公司，在向与伊朗伊斯兰革命卫队（IRGC）有关联的海事管理机构提供进一步服务前，审查其合规计划。帕纳警告该公司要“在为时已晚前采取行动”。
据伊朗在X平台上的帖子显示，波斯湾海峡管理局于8月10日首次表示，其网站因“敌人对互联网服务提供系统的政治影响”而中断。
伊朗请求与美国对话，白宫警告“暴力将以暴力回应”
2026年3月11日周三，从阿联酋的法杰尔港拍摄的霍尔木兹海峡内排队的油轮和货船。（阿尔塔夫·卡德里/美联社照片）
网际基金会首席执行官阿尔普·托克尔告诉福克斯新闻数字频道，该管理局于5月27日被列入美国海外资产控制办公室（OFAC）制裁名单后，便失去了其网络安全凭证。
托克尔表示，标准SSL/TLS证书的缺失导致PGSA的网站无法通过标准浏览器访问。这迫使航运公司使用未加密连接，据托克尔称，此举可能使其数据面临被拦截的风险。
托克尔指出，目前尚无已知的因使用此类连接导致的数据泄露事件，也没有已知案例显示航运公司的数据因证书过期被拦截并造成损害，但该网站无法访问导致了转向他所称的“不安全协议”。
“数字透明度记录在这一点上是权威的，”他说，并补充称，此举将流量转换成了可轻易被拦截的格式。
“这是一类易被政府利用的漏洞，而非企业数据泄露或个人信息泄露。”
托克尔称，这可能会让当局更容易读取通过该平台发送的通信，从而有可能识别出与PGSA合作的航运公司。
特朗普称伊朗将付出代价——结束战争所需条件仍不明朗
2026年2月19日，在伊朗霍尔木兹甘省阿巴斯港联合演习中，伊朗和俄罗斯海军单位模拟营救被劫持船只。（伊朗军方/提供/安纳多卢通讯社 via 盖蒂图片社）
“最终结果是网站更难访问，因为大多数网络浏览器都强烈鼓励使用安全的HTTPS协议，”托克尔说，并补充称，任何表单提交都可能被轻易“窃听，因为它们在传输过程中不再加密”。
8月17日，PGSA在X平台上的另一篇帖子中表示：“上述问题已得到解决，安全域名https://pgsa.ir现在可再次通过任何浏览器提交请求。”
“如果未来问题再次出现，HTTP域名将再次通过火狐浏览器临时可用。”
托克尔证实，伊朗转而求助于总部位于上海的证书颁发机构TrustAsia科技公司，他表示，尽管面临美国制裁，该公司仍为PGSA颁发了新的数字安全凭证，恢复了其网站的安全访问能力。
“伊朗伊斯兰革命卫队通过所谓的波斯湾海峡管理局对途经霍尔木兹海峡的船只进行勒索，”美国财政部在5月将该实体列入制裁名单时表示，并补充称PGSA“带头实施了伊朗控制的、公然违反国际法和美国制裁的勒索计划”。
“任何与所谓海峡管理局合作的实体，可能都在向伊斯兰革命卫队提供支持并接受其服务，而这最终会从这种勒索企图中获益，因此可能面临制裁风险，”美国财政部警告道。
这家中国公司自称是“中国领先的专业认证证书颁发机构，专注于数字世界中的可信、安全和加密通信”。
其使命是“在数字世界的每一处建立信任”。
“几乎所有这些根证书颁发机构都与美国有业务往来，因此它们倾向于遵守美国的制裁规定，”托克尔说。
但他指出，TrustAsia“走了自己的路，构建了以中国优先的证书基础设施，避开了西方”。
托克尔称，TrustAsia“径直为伊朗的PGSA颁发了新证书，伊朗再次通过其安全在线门户向途经海峡的船只收取收入”。
特朗普呼吁阿拉伯国家签署《亚伯拉罕协议》
2021年5月4日在华盛顿拍摄的财政部大楼。美国周三对20名据称参与为伊朗军方提供金融便利网络的个人和公司实施新一轮制裁。财政部的制裁影响了从香港到阿联酋的企业和个人。（美联社照片/帕特里克·塞曼斯基）
帕纳警告称，美国当局对此类行动拥有执法权。
“美国拥有极其广泛的权力，可对向受制裁伊朗公司提供任何形式服务的非伊朗公司实施制裁，”他告诉福克斯新闻数字频道。
“很多时候，这种权力会被简化或解释为向受制裁伊朗公司提供物质支持。但事实上，任何级别的服务都可能成为美国因向伊朗提供服务而对该公司实施制裁的依据。”
“恢复该证书无疑是应受制裁的，”帕纳警告道。
“恢复证书是/曾是向PGSA提供的服务，可依据经修订的第13224号行政命令作为实施制裁的依据。”
“该权力丝毫没有要求服务是‘明知’向PGSA提供的。换句话说，服务的自动化性质无关紧要，也不会使该服务的可制裁性降低，”这位律师补充道。
在8月20日给福克斯新闻数字频道的一份声明中，TrustAsia的一位发言人证实，该公司为pgsa.ir颁发了“域名验证型TLS证书”。
“感谢您将此事告知我们，”该公司表示，随后澄清“DV证书是通过自动化验证对所请求域名的控制权来颁发的”。
伊朗在互联网审查加剧的背景下加速对反政权活动人士的处决行动
伊朗海军武装快艇在霍尔木兹海峡附近的波斯湾海域巡逻。（莫尔塔扎·尼库巴兹/努拉照片 via 盖蒂图片社）
“此流程不会验证或声明运营或受益于该域名的实体的法律身份、隶属关系或制裁状态。
“因此，您的调查中描述的关联在自动化颁发流程中未被识别出来。”经过公司审查后，TrustAsia表示其“已将整个pgsa.ir域名命名空间添加到我们的限制颁发列表中，以防止进一步颁发或更新证书”。
“我们还预计将在本周内完成对现有证书的撤销，”这位发言人在8月20日表示。
TrustAsia称，这些行动是预防性合规和风险控制措施，不应被解读为该证书在技术上存在错误颁发的认定。
托克尔证实，TrustAsia的证书特权已于8月21日12:15:25 UTC被撤销。“这通常意味着颁发机构已采取行动，”他说。
这位互联网专家澄清，撤销将逐渐生效，该公司“发出信号称PGSA的证书不应再被信任，他们正在分发该特权已被撤销的通知，这通常意味着客户滥用或违反了使用条款”。
“安全网站将在大多数浏览器中停止运行，除非其所有者能找到愿意颁发新证书的证书颁发机构，”托克尔说。
伊朗隐形最高领袖成为日益升级的权力斗争中的武器，专家称
美国财政部长斯科特·贝森特称，伊朗制裁导致资本外逃，伊朗领导人据称在镇压抗议活动期间向海外转移了数千万美元。（安娜·莫尼梅克/赛义德·扎雷安/图片联盟 via 盖蒂图片社）
在审阅了TrustAsia的声明后，帕纳还表示，OFAC将期望该公司“借此机会加强其合规计划，以免为时已晚”。
这位前OFAC官员澄清称，伊朗在该水道的收入收集可能会引起华盛顿高层的密切关注。
“伊朗企图在霍尔木兹海峡的石油运输中勒索全世界，这对OFAC来说至关重要，OFAC是执行和实施美国经济制裁的机构。”
由于美国主要网络浏览器目前认可TrustAsia的根证书，美国系统会自动信任这个受制裁的伊朗门户网站。
托克尔称，财政部可能会认定TrustAsia因向受封锁实体提供物质援助而违反制裁规定，这可能会迫使谷歌和微软等科技巨头撤销对TrustAsia的信任。
目前没有证据表明这一流程已经开始或有可能发生。
“这可能会分裂全球信任链，并可能导致西方无法访问大部分中国网络，”托克尔警告道。
伊朗不是你可以与之打交道的正常国家；它是国家安全威胁
2025年7月25日，在德黑兰的一个伊朗革命卫队（IRGC）组织大院的清真寺内，伊朗伊斯兰革命卫队圣城旅指挥官艾哈迈德·瓦希迪、伊斯梅尔·加尼和伊朗革命卫队圣城旅副协调员伊拉吉·马杰迪参加纪念在以色列袭击中丧生的前伊朗革命卫队指挥官侯赛因·萨拉米的仪式。（莫尔塔扎·尼库巴兹/努拉照片 via 盖蒂图片社）
帕纳澄清称，证书可对网站进行身份验证，提升其可信度，并建议TrustAsia本应权衡与受制裁实体合作的风险。
“任何决定与伊朗革命卫队开展业务的公司，都始终面临声誉风险。”
“如果我是TrustAsia的顾问，我至少会立即查明所有其他接受其服务的伊朗革命卫队关联公司。”
帕纳补充称，这一最新情况与政府官员的广泛警告相一致。
“我认为这与贝森特部长的评论非常契合，他表示即将到来的制裁将与以往任何制裁都不同。制裁需要仔细权衡成本和收益。
“当一家中国科技公司为伊朗革命卫队提供必要服务时，我相信美国政府不会在这方面进行任何权衡。”
美国财政部长斯科特·贝森特表示，美国在8月24日制裁了近60个与伊朗有关联的个人、实体和船只，并扩大了次级制裁威胁。这些制裁并未包括TrustAsia。
点击此处下载福克斯新闻应用程序
贝森特将这些措施称为“经济放逐行动”下针对德黑兰全球金融网络的“经济打击”的一部分。
中国大使馆发言人也在一份声明中表示：“我不了解你提到的具体情况，没有相关信息可以提供。”
福克斯新闻数字频道已联系美国财政部和白宫置评。
艾玛·巴锡是福克斯新闻数字频道的突发新闻撰稿人。加入福克斯之前，她曾在《每日电讯报》工作，加入美国夜班团队，负责外交、政治、新闻、体育和文化等多个版面。
China firm gave Iran lifeline to collect Hormuz tolls before pulling plug amid US warning
A former OFAC official urged TrustAsia to bolster compliance ‘before it is too late’
September 18, 2026 12:17pm EDT / Fox News
By Emma Bussey
Former OFAC official warns Chinese tech firms risk US sanctions over services to Iran
Lawyer and former OFAC official Jeremy Paner says even limited services to sanctioned Iranian entities could trigger sanction action.
NEW You can now listen to Fox News articles!
blob:https://www.foxnews.com/fbe59cef-5285-4c74-b42a-99fd3ba803f4
Listen to this article
9 min
Iran’s sanctioned Persian Gulf Straits Authority (PGSA) regained secure online access for four days after a Shanghai-based internet security firm provided and then revoked its web credentials, enabling Tehran to vet vessels, collect Strait of Hormuz tolls and operate despite U.S. digital restrictions, global internet monitors said.
TrustAsia issued an automated domain-validated certificate, a routine process that verifies control of a website domain through server checks and typically does not involve manual vetting or background checks.
The move prompted U.S. sanctions experts, including Jeremy Paner, a partner at Hughes Hubbard & Reed, to urge TrustAsia to review its compliance program before offering further services to the IRGC-linked maritime authority — with Paner warning them to act “before it is too late.”
The PGSA first said its website was disrupted Aug. 10 because of “the enemy’s political influence on the internet service provision systems,” according to a post on X.
IRAN REQUESTS TALKS WITH US AS WHITE HOUSE WARNS ‘VIOLENCE WILL BE MET WITH VIOLENCE’
Oil tankers and cargo ships line up in the Strait of Hormuz as seen from Mina Al Fajer, United Arab Emirates, Wednesday, March 11, 2026.(Altaf Qadri/AP Photo)
NetBlocks CEO Alp Toker told Fox News Digital that the authority had lost its web security credentials after the entity was added to the U.S. Office of Foreign Assets Control (OFAC) sanctions list on May 27.
The loss of standard SSL/TLS certificates, Toker said, made the PGSA website inaccessible using standard browsers. This forced shipping firms to use unencrypted connections that, according to Toker, could leave their data vulnerable to interception.
While no data breaches resulting from the use of these connections have been made known, and there are no known instances in which a shipping firm’s data was intercepted and used to its detriment because of the certificate expiration, Toker said the site’s inaccessibility resulted in a shift to what he described as “insecure protocols.”
“The digital transparency records are authoritative on this,” he said, adding that the measure forced the traffic into a format that could be readily intercepted.
“This is a class of vulnerability open to government exploitation, rather than a corporate breach or personal data leak.”
Toker claimed this could make it easier for authorities to read communications sent through the platform, potentially identifying shipping firms collaborating with the PGSA.
TRUMP SAYS IRAN WILL PAY — WHAT IT TAKES TO END THE WAR REMAINS UNCLEAR
Naval units from Iran and Russia simulate the rescue of a hijacked vessel during joint drills at the Port of Bandar Abbas in Hormozgan, Iran, on Feb. 19, 2026.(Iranian Army/Handout/Anadolu via Getty Images)
“The net result was that the website was more difficult to access, because most web browsers strongly encourage the use of secure HTTPS,” Toker said, adding that any form submissions could have been easily “eavesdropped on because they’re no longer encrypted in transit.”
“The mentioned issue has been resolved, and the secure domain https://pgsa.ir is now once again available for submitting requests using any browser,” the PGSA said six days later on Aug. 17 and in another post shared on X.
“If the issue recurs in the future, the HTTP domain will again be temporarily available using the Firefox browser.”
Toker confirmed that Iran had turned to Shanghai-based certificate authority TrustAsia Technologies, which he said issued new digital security credentials to the PGSA despite the U.S. sanctions, restoring secure access to its website.
“Iran’s IRGC extorts vessels transiting the Strait of Hormuz through the so-called Persian Gulf Strait Authority,” the Treasury Department said in May when designating the entity, adding that the PGSA “spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S. sanctions.”
“Anyone cooperating with the so-called strait authority may be providing support to and receiving services from the IRGC, which ultimately benefits from this attempted extortion, and may therefore be exposed to sanctions risk,” the Treasury Department warned.
The Chinese firm bills itself as a “leading and professionally certified certification authority in China with its focus on trusted, secure and cryptographic communications in the digital world.”
Its mission, it says, is to “Build trust everywhere in the digital world.”
“Almost all of these root authorities do business with the U.S., so they tend to comply with U.S. sanctions,” Toker said.
But TrustAsia, he noted, had “gone its own way, building a China-first certificate infrastructure that sidesteps the West.”
Toker said TrustAsia had “simply gone ahead and issued Iran’s PGSA with a new certificate, and Iran was once again collecting revenue from ships passing the Strait via its secure online portal.”
TRUMP CALLS ON ARAB NATIONS TO SIGN ABRAHAM ACCORDS
The Treasury Building is viewed in Washington, May 4, 2021. The U.S. on Wednesday imposed a new round of sanctions on a group of 20 people and firms allegedly involved in a financial facilitation network for the benefit of the Iranian military. The Treasury Department sanctions impact firms and people spanning from Hong Kong to the United Arab Emirates.(AP Photo/Patrick Semansky)
Paner warned that U.S. authorities would have enforcement powers over such actions.
“The U.S. has incredibly broad authority to impose sanctions on non-Iranian companies that provide any sorts of services to sanctioned Iranian companies,” he told Fox News Digital.
“Many times, that authority will be abbreviated or explained as being providers of material support to sanctioned Iranian companies. But in fact, any level of services whatsoever could be the basis for the United States imposing sanctions against the company for providing services to Iran.”
“Restoration of the certificate is unequivocally sanctionable,” Paner warned.
“Restoring the certificate is/was a service provided to the PGSA, which can be the basis for imposing sanctions pursuant to Executive Order 13224, as amended.
“That authority does not in any way require that the service be ‘knowingly’ provided to the PGSA. In other words, the automated nature of the service is irrelevant and does not make the service any less sanctionable,” the lawyer added.
In a statement to Fox News Digital on Aug. 20, a spokesperson for TrustAsia confirmed that the firm issued a “Domain Validated TLS certificate for pgsa.ir.”
“Thank you for bringing this matter to our attention,” the firm said before clarifying that “DV certificates are issued through automated validation of control over the requested domain names.”
IRAN ACCELERATES EXECUTION CAMPAIGN AGAINST ANTI-REGIME ACTIVISTS AMID INTERNET CENSORSHIP
Iranian Navy soldiers on an armed speed boat in the Persian Gulf near the Strait of Hormuz.(Morteza Nikoubazl/NurPhoto via Getty Images)
“This process does not verify or assert the legal identity, affiliation, or sanctions status of the entity operating or benefiting from the domain.
“As a result, the relationship described in your inquiry was not identified during the automated issuance process.” Following the firm’s review, TrustAsia said it “added the entire pgsa.ir domain namespace to our restricted-issuance list to prevent further issuance or renewal.”
“We also expect to complete revocation of the existing certificate within this week,” the spokesman said on Aug. 20.
These actions are precautionary compliance and risk-control measures. They should not be interpreted as a finding that the certificate was technically misissued, TrustAsia said.
Toker confirmed the TrustAsia certificate’s privilege had been withdrawn on Aug. 21 at 12:15:25 UTC. “This usually means the issuer has taken action,” he said.
The internet expert clarified that the revocation will gradually be coming into effect, with the firm “signaling that the PGSA certificate should no longer be trusted, and they’re distributing this notice that privilege is withdrawn, usually meaning customer misuse or breached terms of use.”
“The secure website will stop working in most browsers, unless the owners can find a certificate authority that’s willing to issue a new certificate,” Toker said.
IRAN’S UNSEEN SUPREME LEADER BECOMES WEAPON IN ESCALATING POWER STRUGGLE, EXPERTS SAY
Iran sanctions prompt capital flight as Treasury Secretary Scott Bessent reports Iranian leaders allegedly wired tens of millions overseas amid protest crackdowns.(Anna Moneymaker/Saeid Zareian/Picture Alliance via Getty Images)
After reviewing TrustAsia’s statement, Paner also said that OFAC would expect the company to “use the discovery as an opportunity to enhance its compliance program before it is too late.”
The former OFAC official clarified that Iran’s revenue collection in the waterway would likely draw high-level scrutiny in Washington.
“Iran’s attempt to extort the world in the movement of oil through the Strait of Hormuz is of the utmost importance to OFAC, which is the agency that implements and enforces U.S. economic sanctions.”
Because major U.S. web browsers currently recognize TrustAsia’s root certificates, American systems would have automatically trusted the sanctioned Iranian portal.
Toker claimed the Treasury Department could have found TrustAsia in violation of sanctions for providing material assistance to a blocked entity, potentially forcing tech giants such as Google and Microsoft to revoke trust in TrustAsia.
There is no evidence that this process had begun or was likely to occur.
“This could have splintered the global chain of trust and potentially render much of the Chinese web inaccessible from the West,” Toker warned.
IRAN IS NOT A NORMAL NATION YOU CAN MAKE DEALS WITH; IT’S A NATIONAL SECURITY THREAT
Ahmad Vahidi, commander of the Islamic Revolutionary Guard Corps Quds Force, Esmail Qaani, and Iraj Masjedi, deputy coordinator of the Islamic Revolutionary Guard Corps (IRGC) Quds Force, participate in a ceremony to mark the memory of former IRGC commander, Hossein Salami, who is killed in Israeli attacks, at a mosque in an IRGC organizational house complex in Tehran, Iran, July 25, 2025.(Morteza Nikoubazl/Nur Photo via Getty Images)
Paner clarified that the certificates authenticate the site, boosting its credibility, and suggested TrustAsia should have weighed the risks of working with sanctioned entities.
“There’s always reputational risk involved in any company that decides to do business with the IRGC.”
“If I were advising TrustAsia, I would at minimum immediately identify all other IRGC companies receiving services.”
Paner added that this latest situation aligned with broader warnings from administration officials.
“I think this dovetails pretty nicely with Secretary Bessent’s comments about how the coming sanctions are going to be unlike any that has come prior. Sanctions require a careful balancing of the costs and the benefits.
“When it’s a Chinese tech company providing necessary services to the IRGC, I’m confident that the U.S. government is going to forego any sort of balancing in that regard.”
The United States on Aug. 24 had sanctioned nearly 60 Iran-linked individuals, entities and vessels and expanded the threat of secondary sanctions, Treasury Secretary Scott Bessent said. These did not include TrustAsia.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Bessent described the measures as part of an “economic onslaught” targeting Tehran’s global financial networks under “Operation Economic Outcast.”
A Chinese Embassy spokesperson also said in a statement: “I am not aware of the specifics you mentioned. I have no information to provide.”
Fox News Digital reached out to the U.S. Department of the Treasury and the White House for comment.
Emma Bussey is a breaking news writer for Fox News Digital. Before joining Fox, she worked at The Telegraph with the U.S. overnight team, across desks including foreign, politics, news, sport and culture.
发表回复