Iranian Tech Users Are Getting Knocked Off the Web by Ambiguous Sanctions

Between targeted killings, retaliatory air strikes, and the shooting of a civilian passenger plane, the last few weeks have been marked by tragedy as tensions rise between the U.S. and Iranian governments. In the wake of these events, Iranians within the country and in the broader diaspora have suffered further from actions by both administrations—including violence and lethal force against protesters and internet shutdowns in Iran, as well as detention, surveillance and device seizure at the U.S. border and exacerbating economic conditions from U.S. sanctions. And to make matters worse, American tech companies are acting on sanctions through an overbroad lens, making it much harder for Iranian people to be able to share their stories with each other and with the broader world.

The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury administers and enforces economic and trade sanctions that target foreign countries, groups, and individuals. Some of these sanctions impact the export to Iran (or use by residents of the country) of certain types of technology, although trying to parse precisely which types are affected appears to have left some companies puzzled.

For example, this week Instagram removed a number of accounts from its service that were affiliated with the Iranian Revolutionary Guard Corps (IRGC)—which is specially designated by OFAC—as well as some accounts praising the IRGC and some condemning the group. The platform initially justified its actions stating:

We review content against our policies and our obligations to US sanctions laws, and specifically those related to the US government’s designation of the IRGC and its leadership as a terrorist organization.

While Instagram is indeed obligated to remove accounts affiliated with the IRGC, the law does not extend to unaffiliated accounts providing commentary on the IRGC—although some experts say that posts supporting a specially designated group could be seen as providing support to the group, thus violating sanctions.

In any case, Instagram may choose to remove accounts praising the IRGC under its own community standards. In the end, Instagram ended up restoring at least one account following media criticism.

A long hard road

EFF has long observed tech companies’ struggle with OFAC sanctions. In 2012, an Apple employee refused to sell a laptop to a customer who was overheard speaking Persian, prompting the State Department to issue a clarifying statement:

[T]here is no U.S. policy or law that prohibits Apple or any other company from selling products in the United States to anybody who’s intending to use the product in the United States, including somebody of Iranian descent or an Iranian citizen or any of that stuff.

In 2013, we spoke up when Airbnb booted an Iranian resident of Switzerland from their platform without recourse, resulting in a reversal of the decision.

And now, as tensions between the U.S. and Iran heat up, we’re seeing tech companies booting Iranians from their platforms left and right. For example:

• Github closed the account of a computer science professor teaching at a Canadian university
• GoFundMe suspended two different Canadian campaigns to raise funds for a memorial service for the crash victims of the Ukrainian airliner flight PS752
• Iranians have reported being blocked from downloading the Twitter app from Google’s Play Store.
• YouTube suspended the UK branch of an Iranian government-funded broadcast outlet

…But are these companies correct in stripping Iranians of their accounts? The answer: It’s complicated.

Iran is subject to certain OFAC sanctions, and in addition to that, the IRGC and certain Iranian nationals are on OFAC’s list of “specially designated nationals.” OFAC sanctions can be interpreted broadly by tech companies, which is why in 2010, the Treasury Department issued a general license intended as a blanket license for the export of “certain services and software incident to the exchange of personal communications over the Internet, such as instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging, provided that such services are publicly available at no cost to the user.”

In 2014, that license was amended to include even more products, including certain fee-based services “incident to the exchange of personal communications over the Internet” including social networking. The new license, General License D-1, provided greater clarity to companies on what is and is not subject to sanctions. As the National Iranian American Council pointed out in a 2017 letter, General License D-1 has been widely praised for “securing human rights, protecting access to online information, and avoiding government censors.”

As the events of this week demonstrate, companies are still struggling to understand the rules. And understandably so—as Richard Nephew, a sanctions expert and senior research scholar at Columbia University told CNN:

[T]his is a tough gray area as we also have free speech protections too.  This is why I think companies often make mistakes in this area, both by preventing such posts or activities and by allowing them …

But while the rules might be difficult, companies are making things worse by failing to properly communicate to users about why their accounts have been suspended—and by giving misleading or incorrect statements to the media.

Why does this matter?

Sanctions that prevent the free flow of communications on the internet and hamper ordinary the ability of ordinary Iranians to express themselves often harm the very people they’re intended to help. Over the years, we’ve seen how sanctions on tech—as well as misapplication or overbroad application of such sanctions—hurt individuals from all walks of life by denying them access to information and cutting them off from communication with the rest of the world.

After the 2014 issuance of General License D-1 for Iranians, Sudanese citizens embarked on a campaign for a similar license, arguing that sanctions prevented them from accessing e-books, online courses, and other information. In a country where the government bans books and at times seizes newspapers, the knowledge that can be gained online can make all the difference. For Iranians, greater access can also mean safer access—to VPNs, secure messaging apps, and other vital tools.

But it isn’t just access to information—it’s also the information coming out of Iran that’s affected. When a Ukrainian airliner was struck down in Iranian airspace, it was video taken from inside the country—as well as efforts by individuals in Iran—that led to verification that Iran’s government had struck the plane with a missile. As we’ve pointed out before, policies intended to prevent violent extremists from using online services often have the effect of silencing human rights content. And given how little access international media has to Iran, hearing from Iranians about what’s happening on the ground is vital.

Furthermore, Iran has seen fit in the past to shut down the Internet, preventing its residents from accessing the outside world. If the U.S. government truly believes in the internet freedom policy that it continues to pour millions of dollars into, it should see how its own policies are working against freedom and pushing Iranians toward local services that are likely heavily surveilled or censored. As it stands, the U.S. is just helping Iran do the job of silencing its citizens.

A clearer way forward

As moral panic and confusion set in, more and more companies are seeking to enforce sanctions law—and as they do, it’s vital that they have the best possible information at hand so ordinary citizens aren’t unduly impacted. As such, we are reiterating our ask for the Department of Treasury to update General License D-1 and provide guidance to U.S. tech companies to ensure the minimal amount of damage to users.

But although sanctions are hard, we also call on tech companies to exercise both caution and compassion as they navigate these murky waters. Companies should ensure that they’re using the best possible means to identify potentially impacted users; notify them clearly (by providing information about specific statutes and links to relevant information from the Department of Treasury); and most importantly, provide an appeals system so that users who are wrongly identified have a path of recourse to regain access to their accounts.