The customer's customer

Posted on: 6 October 2026

In 2023 Britain exported £273m of motor vehicles to Azerbaijan. The figure comes from HMRC's own trade statistics, as analysed by Sky News the following spring, and it stood 1,860 per cent above the average of the five years before Russia invaded Ukraine, which put it within sight of the £330m a year in cars that Britain had been sending to Russia itself before sanctions closed that market. Over the same period United Nations data showed Azerbaijan's car exports to Russia climbing at a rate with no precedent, while the country's income per head stayed roughly where it had been. Asked about the numbers, the Society of Motor Manufacturers and Traders replied that exports to Azerbaijan had risen for several reasons, "not least a flourishing economy". Nobody suggested that a British manufacturer had broken the law and as far as I know none had.

I was reminded of that reply last week. On Thursday 1 October the US Justice Department announced the arrest of Greg Lui, thirty-eight, of San Gabriel, California, who owns a company in City of Industry called Earthmade Computer. The indictment, returned on 29 September, alleges that in 2023 and 2024 he bought servers worth more than $300m from American manufacturers, told them the machines were bound for Malaysia or Singapore, where no export licence is required, and had them sent on to China, where one is. One order, placed in January 2024, was for 27 servers at about $7,614,000, and two months later, according to prosecutors, a co-conspirator emailed a Malaysian government official to confirm that those 27 machines had been transshipped to a buyer in China. These are allegations and Lui is presumed innocent.

The press release, for what it is worth, refers throughout to "Super Intelligence (SI)", an abbreviation I had not seen a prosecutor use before.

The same day Bloomberg published a long investigation into the wider trade, built around a case from March in which three people, among them the Super Micro co-founder Yih-Shyan Liaw, were charged over roughly $2.5bn of servers with Nvidia chips said to have been diverted to China. Liaw has pleaded not guilty. The declared buyer, unnamed in the indictment and identified by Bloomberg as a Bangkok company called OBON, was officially building artificial intelligence infrastructure in Thailand. According to the officials Bloomberg spoke to, housing what it bought would have taken a hundred megawatts of data centre capacity that OBON did not have, in a country where the whole installed base of that kind runs to a few hundred. Their question to Nvidia is how this went unnoticed. Nvidia's answer was that a startup's growth plan in a friendly country ought to be read as an opportunity for America, and that American companies "honor US laws as they are, not as America's critics wish they were".

A flourishing economy in Baku and a growth plan in Bangkok are the same answer given twice. On the letter of the law it is a sound one, since Nvidia has never been accused of abetting smuggling and I have no grounds for thinking anyone there knew.

Nobody needs to have known, though, because of where the money and the information sit. Nvidia books its revenue when the processor passes to whoever assembles the server, and from that point the place where the machine is eventually switched on moves nothing in its accounts, whereas the cost of discovering a diversion falls entirely on federal prosecutors and on the Commerce Department bureau that issues the licences. The sales data are held by a party that loses nothing by leaving them unread. In an arrangement like that the warning signs go unseen without anybody ever having decided not to see them.

The Americans have been through this once before, in a business that has nothing to do with semiconductors. Kermit is a town of about four hundred people in West Virginia, on the Kentucky line, and over two years its one pharmacy, the Sav-Rite, took delivery of nearly nine million hydrocodone pills. On 8 May 2018 the heads of the large drug distributors, McKesson and Cardinal Health among them, sat before a House subcommittee, where the Republican chairman of the Energy and Commerce Committee, Greg Walden, said he could find no logical explanation for that figure. Cardinal's chairman apologised. The industry's general position remained that over-prescribing was the doctors' affair, even though a duty to report suspicious orders had been in the federal regulations since 1971.

For decades ignoring that duty had cost very little, until on 11 July 2017 Mallinckrodt, one of the largest makers of generic oxycodone, paid $35m without admitting any violation and the Justice Department argued for the first time that a manufacturer has to look past its direct customer to its customer's customer. The instrument was chargeback data, the records distributors sent the company in order to claim their discounts, which is to say information it already held for commercial reasons and which nobody had ever made it expensive not to read. Four years later the three big distributors agreed to pay up to $21bn over eighteen years. What brought them there was some three thousand lawsuits filed by states, counties and cities.

The comparison gives way in two places. Opioids killed people in the seller's own country and so produced victims with an address and a lawyer, whereas a server diverted to China produces no claimant at all. And the state never wavered on oxycodone, while on chips it has, given that in December 2025 the White House authorised sales to China of the H200, Nvidia's previous generation. It is hard to ask a vendor for more rigour than a government that has not yet settled whether the sale does harm.

If liability travels up this chain, then, it will come from Congress. On 26 March the House Foreign Affairs Committee approved the Chip Security Act by 42 votes to nil. The bill would require location verification on advanced processors and oblige exporters to report a chip that turns up where it should not, which is the Mallinckrodt settlement written in advance as statute. Six months on I can find no sign that it has reached the floor.

British readers will recognise the legal form, because Parliament has been building it for sixteen years. Section 7 of the Bribery Act 2010 made a company liable for bribery by anyone associated with it unless it could show adequate procedures, the Criminal Finances Act 2017 did the same for the facilitation of tax evasion, and since 1 September 2025 large organisations have faced a failure to prevent fraud offence under which the burden of proving reasonable procedures rests on the company. Each of these makes not looking the expensive option. Each also stops at the people who act on the firm's behalf and none reaches as far as a customer, still less a customer's customer, and none covers sanctions or export controls. The Azerbaijan cars fell outside all three.

Nvidia adds that Huawei's progress has made smuggling unnecessary. Perhaps, but a man who risks up to twenty years in prison to move 27 servers is offering a view on Chinese demand and it carries more weight than a press office's.

Any firm that sells through intermediaries holds numbers of this family somewhere in its systems, a customer buying more than it could physically install or resell in the market it declares, and at present no rule obliges anyone to read them. The distributors' experience suggests that the question of what the law required lasts only until somebody changes the forum, after which the question becomes what was in the records and since when.

Sky News found the Azerbaijan figure in a table that HMRC publishes every month.