Locked out: Did US tech company overcomply with Iran sanctions?

“GitHub blocked my account and they think I’m developing nuclear weapons.”

That was how one person on the creative forum Medium reacted this week to a controversial move by the United States-based software code-hosting service. On July 25, GitHub began limiting users linked to Iran, and several other countries under US sanctions, access to its services.

Elsewhere, the word “ridiculous” appeared several times on a Twitter thread lamenting GitHub’s actions.

Many of the controls were rolled back three days later. But the move was enough to reignite debates about whether some US companies are unnecessarily punishing citizens of countries targeted by sanctions so as to avoid coming under fire themselves, something many people on the receiving end of such actions are calling “over-compliance”.

These people argue that companies like GitHub are inadvertently compromising the very online freedoms and global open source communities they were set up to facilitate.

The company says it is merely abiding by United States laws which restrict trade with countries like Iran that are under sanctions.

And GitHub is not alone. Other tech companies including Google and Apple have also ended up hurting Iranian users as they sought to comply with tightened sanctions.

GitHub, which was bought by Microsoft in 2018 for $7.5bn, offers coders an online place where they can store their work and collaborate so-called public repositories. Developers can also set up private repositories to work on their projects solo. Another service, called GitHub Pages, acts as a hosting service for websites.

The company is an online home to roughly 30 million software developers around the world, giving them a platform to connect to, and learn from, each other.

But on July 25, many Iranian developers, inside the country and living elsewhere, received emails from GitHub saying: “Due to US trade controls law restrictions, your GitHub account has been restricted.”

Their repositories were closed without any notice, denying them the chance to download their content or export them anywhere else. Many users also reported being blocked from GitHub Pages, losing access to personal and organizational information.

And it seemed, to some users, that GitHub was targeting people based on their nationality and ethnicity, since Iranians living overseas were also affected.

Users can appeal against the firm’s move by filling out an online form that asks whether they have visited any of the embargoed countries in the last 24 months, and why. They also have to provide pictures of themselves and copies of their photo identification documents.

‘Free flow of information’

GitHub’s updated trade controls guidelines say its vision is “to be the global platform for developer cooperation, no matter where developers reside” and that it believes offering free services “supports US foreign policy of encouraging the free flow of information and free speech”.

But it also makes it clear that there is no working around government sanctions.

Since US President Donald Trump unilaterally withdrew from Iran’s nuclear deal with world powers in May 2018, multiple rounds of choking sanctions have hit almost every sector of the Iranian economy.

But GitHub’s ban does not only apply to Iranian users. According to the company’s trade control guidelines, restrictions also apply to customers from Crimea, Cuba, North Korea and Syria.

One of those users is someone who goes by the name Anatoliy Kashkin on his website, and tkashkin on GitHub. He says he is 21 years old and a Russian citizen living in Crimea. His website says he develops games and apps like a “smart kettle control utility”.

“My GitHub account has been restricted due to US sanctions as I live in Crimea. I may not be able to continue maintaining GameHub in future,” he wrote on his GitHub page.

GitHub’s move came as a shock to people inside and outside sanctioned jurisdictions, according to a 40-year-old Tehran-based programmer and communications expert, known professionally as Jadi.

When the company imposed the ban, he and his audiences lost access to four of his books among other projects that used GitHub Pages.

“In addition to offering technical services, GitHub is a major pool of developers, so being cut off from it is a huge blow,” Jadi told Al Jazeera.

“A sudden closure of access to private repositories would also mean a serious halt in activities for businesses or inability to participate in projects.”

The programmer believes that sanctions impede the free flow of online communication between nations and the development of joint products by international peers.

‘Over-enforcement’

In a statement, the Washington-based nonprofit National Iranian American Council said it is deeply concerned about how GitHub targeted Iranians, calling it “a potential over-enforcement of US sanctions on Iran.”

“Such actions cause profound distress to individuals of Iranian descent, and it is important that GitHub not implement policies in an over-inclusive manner so as to discriminate against persons of Iranian descent,” it said. 

Just a day before GitHub’s restrictions went into effect, Special US Representative for Iran Brian Hook denied the US sanctions technology used for communications in Iran, calling it a “myth”.

“Unlike your regime, we believe strongly in the free flow of communication and information,” Hook said in a televised message. “You deserve access to information and to be able to communicate with each other and the world.”

While US officials maintain that their hard-hitting economic sanctions are aimed at squeezing Iran’s rulers, recent history has shown that people and businesses end up losing the most.

GitHub’s CEO Nat Friedman conceded that trade restrictions have hurt people, tweeting: “We have gone to great lengths to do no more than what is required by the law, but of course people are still affected.”

“We’re not doing this because we want to; we’re doing it because we have to,” Friedman wrote.

His response came after a tweetstorm by users who were concerned about the extent and implementation method of the restrictions.

“Dear GitHub, If it is not against US sanctions, may I access the source codes of my PhD projects which unfortunately I had uploaded on your site? I promise to take my files and delete my account,” tweeted an Iranian user.

GitHub eventually eased the restrictions for some users, by allowing them to turn their private repositories into public ones, and then letting them access their information.

But as many users pointed out, going public would at least temporarily expose their projects to the public. For companies trying to keep innovations secret from competitors, for example, such a solution would be far from ideal.

GitHub’s restrictions are not the first barriers put in the way of Iranian startups by American companies. 

Last year, Google blocked Iranian businesses from using its Google Maps services, a move which, among other things, prompted local ride-hailing apps to quickly switch to other options.

In late December 2018, US cloud-based instant messaging service Slack implemented sweeping bans on Iranians due to US sanctions, even if they had left the country.

After a tweetstorm and international media coverage, the company was forced to apologize for what it called “inadvertently deactivating a number of accounts that we shouldn’t have”.

And over the last few months, Apple has been removing a number of major Iranian applications from its store, citing misuse of its enterprise developer certificates. This has forced Iranian businesses to upload new versions of their apps onto the store every time they’re taken down, lest they lose their local user base.

Forced to toughen up

The alarming sequence of events has hardened the attitudes of Iranian businesses leaders who have had no choice but to adapt, says Payam Chamani, chief technology officer (CTO) of mobile and web software development company Nizek.

“We have come to terms with the insanely difficult conditions and have learned that we must stand on our own feet,” Chamani told Al Jazeera.

Nizek is a Kuwait-based company but employs a number of Iranian developers who work from Tehran. The first day of the GitHub ban caused concern and confusion at the company since its developers were suddenly cut off from their code, seemingly without any prospect of getting it back.

“Not having full access to GitHub is bad, especially since we regularly paid for their services and had a close connection with their support staff, but we can live without it,” Chamani said.

According to the CTO, the company is now using BitBucket, another repository hosting service owned by Australian enterprise software company Atlassian. 

The company is also uploading data onto its own servers, which is costlier and requires more maintenance. But, Chamani says doing so will likely prevent another company-wide shock.