This article is based on reporting originally published by ZDNet in July 2019.
Overview
In late July 2019, Microsoft-owned GitHub began restricting accounts belonging to developers located in countries subject to US trade sanctions. The move affected users in regions listed on GitHub’s US trade controls page — Crimea, Cuba, Iran, North Korea, and Syria — and triggered a broader debate about the impact of geopolitical compliance obligations on open-source software development and developer access.
The Incident That Sparked the Debate
The situation gained public attention when Anatoliy Kashkin, a 21-year-old Russian citizen living in Crimea, reported that GitHub had notified him his account had been “restricted due to US trade controls.” Kashkin used GitHub to host his personal website and to develop GameHub, an open-source game launcher for Linux that aggregates titles from Steam, GOG, and Humble Bundle into a single interface.
The restriction posed a practical problem beyond simple inconvenience. While his website could be migrated to any alternative hosting provider, GameHub had accumulated an established user base and contributor community on GitHub. Kashkin noted that discoverability and issue tracking — both central to open-source project health — would suffer significantly if the project were forced off the platform.
“GitHub has many useful features and it’s safe to assume that many people interested in GameHub already use GitHub. Discoverability is also a very important factor. I don’t think many people will find GameHub on a self-hosted server somewhere.”
— Anatoliy Kashkin, GameHub developer
How GitHub’s Restrictions Work
GitHub’s trade controls policy distinguishes between its cloud-hosted service (GitHub.com) and its on-premises enterprise product. According to GitHub’s own documentation at the time:
- GitHub.com (cloud): Restricted for users in sanctioned regions. Individual users in those countries could, in limited cases, retain access to public repository services for personal communications only.
- GitHub Enterprise Server (on-premises): Not subject to the same geographic restrictions, making it a potential alternative for enterprise users in affected regions.
- Export control compliance: GitHub reminded users that they are individually responsible for ensuring their code and data comply with US Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR).
GitHub did offer an appeals process for account restrictions, but Kashkin told ZDNet the process was not viable in his case. To lift the restriction, GitHub required proof that he did not live in Crimea — which he could not provide, as he is a Russian citizen with Crimean registration who has lived there his entire life.
Iran Also Affected
Kashkin was not alone. Iranian developer Hamed Saeedi posted publicly — on Medium — describing how GitHub had blocked his account despite his having used the platform since 2012. The notification he received mirrored Kashkin’s:
“Due to U.S. trade control law restrictions, your GitHub account has been restricted. For individual accounts, you may have limited access to free GitHub public repository services for personal communications only.”
— GitHub account restriction email, as reported by Hamed Saeedi
Saeedi’s Medium post, titled “GitHub blocked my account and they think I’m developing nuclear weapons,” drew widespread attention to what appeared to be a broad, automated restriction applied to Iranian accounts, regardless of the nature of the developer’s work.
Why US Trade Sanctions Apply to GitHub
GitHub operates as an online service and is therefore subject to US Office of Foreign Assets Control (OFAC) regulations. As a company incorporated in the United States and owned by Microsoft, it must comply with sanctions that restrict the provision of services — including software and cloud hosting — to entities in designated countries or territories.
At the time of these reports, GitHub stated it was in discussions with US regulators to explore how it might expand access for developers in affected regions while remaining compliant with the law.
Alternatives and Their Limitations
Fellow developers suggested that Kashkin and others in similar positions consider alternative Git hosting services. The two most commonly cited were:
- GitLab: Headquartered in the United States, and therefore potentially subject to the same OFAC compliance requirements.
- Bitbucket (Atlassian): Founded in Australia, but listed on the US NASDAQ exchange since 2015, which may bring similar legal obligations.
Self-hosted alternatives — such as a privately run Gitea or GitLab CE instance — are not subject to US service-provider sanctions in the same way, but they sacrifice the discoverability, community tooling, and network effects that make platforms like GitHub valuable for open-source projects.
Wider Implications for Open-Source Communities
The restrictions highlighted a tension that the open-source community had not been forced to confront at scale before: the fundamental principles of open collaboration and free access to code sit uneasily alongside the export-control frameworks that govern US-based technology platforms.
For developers in sanctioned regions, losing access to dominant platforms like GitHub means more than losing a code host. It affects:
- Project visibility: The ability for others to discover, star, fork, or contribute to a project.
- Issue tracking and collaboration: Communication with contributors and users through issues and pull requests.
- CI/CD integration: Automated pipelines tied to GitHub Actions or third-party services connected to GitHub repositories.
- Package distribution: Some ecosystems use GitHub as a primary distribution channel for libraries and tools.
GitHub’s Subsequent Actions
Following public pressure in 2019 and into 2020, GitHub took steps to expand access for developers in Iran and other affected regions — particularly for open-source projects — while remaining within the bounds of US law. However, the specific scope and timeline of those changes fall outside the events described in this article and should be verified against current GitHub policy documentation.
Key Takeaways for DevOps Teams
- If your organization employs contractors or contributors located in OFAC-sanctioned regions, your GitHub-based workflows may be disrupted unexpectedly.
- Open-source maintainers should consider whether their project’s reliance on a single US-based platform creates single points of failure for international contributors.
- Enterprises operating in or hiring from affected regions should evaluate self-hosted or multi-region source control strategies as part of their vendor risk assessments.
- GitHub’s on-premises Enterprise Server product was specifically cited as a potential alternative for teams that need control over geographic access restrictions.
Original reporting by ZDNet, July 2019. GitHub had been contacted for comment at the time of original publication.