GitHub Restricts Developer Accounts in Countries Under Trade Sanctions

In a sign of the far-reaching impact of US sanctions, GitHubOpens a new window , the open-source software hosting service, has begun restricting the accounts of developers in regions subject to the trade restrictions including Iran, Syria and Crimea.

The issue was first reported by ZDNetOpens a new window last week after a developer named Anatoliy Kashkin, who lives in the Russian-annexed Crimea region of Ukraine, wrote that his GitHub account had been disabled as a result of the sanctions.Opens a new window

The San Francisco-based GitHub – which counts 37 million users worldwide and is owned by Microsoft – confirmed the action, with chief executive Nat Friedman taking to TwitterOpens a new window to say: “To comply with U.S. sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts” in the three regions.

“It is painful for me to hear how trade restrictions have hurt people,” Friedman said. “GitHub is subject to U.S. trade law, just like any company that does business in the U.S.” The restrictions were based on IP addresses and payment histories, which means developers can face blocks while visiting the areas.

Obama, Trump imposed sanctions

President Barack Obama imposed sanctions on Syria and Crimea during his administration, and President Donald Trump signed off on new trade sanctions against Iran at the end of June. Trade with North Korea and Cuba have long been prohibited by US sanctions.

Appeals are possible, but as Kashkin wrote: “It is just pointless. My account is flagged as restricted and, in order to unflag it, I have to provide a proof that I don’t live in Crimea. I am in fact a Russian citizen with Crimean registration, I am physically in Crimea, and I am living in Crimea my entire life.”

About 70% of GitHub’s users live outside the United States.

Some users suggested migrating to other hosting services such as GitLabOpens a new window , or the Australian-based BitBucketOpens a new window . But with GitLab based in the United States and BitBucket listed on Nasdaq, both are likely to face similar restrictions.

A retort from Iran

Another GitHub user based in Iran reported on the blogging platform MediumOpens a new window that his account has been blocked. Developer Hamed Saeedi wrote: “You think that some government agency would use a private GitHub repository as storage for military secrets?”

GitHub notes that users are responsible for ensuring the content they develop and share on Github.com complies with American export control laws, including the Export Administration Regulations and the U.S. International Traffic in Arms Regulations or ITAR.

But an alternative it suggested is actually a paid software platform aimed at enterprise customers.

“The cloud-hosted service offering available at Github.com has not been designed to host data subject to the ITAR and does not currently offer the ability to restrict repository access by country,” GitHub says. “If you are looking to collaborate on ITAR- or other export-controlled data, we recommend you consider GitHub Enterprise Server, GitHub’s on-premises offering.”

Closing doors?

Individual developers might have cause for concern that the open source world is becoming less so.

SlackOpens a new window , the workplace messaging provider linked to GetLab, apologized after it disabled links to developers in sanctioned countries. Users were in uproarOpens a new window , citing examples of their accounts being blocked years after they had traveled to Iran, Cuba or Crimea.

The company, which counts eight million users, said that instead it would begin blocking access to its service from IP addresses associated with an embargoed country.

“Users who travel to a sanctioned country may not be able to access Slack while they remain in that country. However, we will not deactivate their account, and they will be able to access Slack when they return to countries or regions where no blocking is required.”