Original reporting credit: winbuzzer.com and ZDNet (2019).
Background: GitHub and US Trade Sanctions
In July 2019, Microsoft-owned GitHub began restricting repositories belonging to developers located in countries subject to US trade sanctions. The move triggered widespread discussion in the developer community, with more affected users coming forward after the initial reports. GitHub had initially stayed silent on its precise legal reasoning, but in September 2019, the company offered a more detailed public explanation.
The company stated it was doing “no more than what is required” under US trade law, and later expanded that position: GitHub was doing only the bare minimum necessary to remain compliant with those laws.
How the Issue Came to Light
The story became public when Anatoliy Kashkin, a 21-year-old Russian developer based in Crimea, received a notice from GitHub informing him that his account had been restricted. The notice directed him to GitHub’s page on US trade controls. The countries listed as subject to trade sanctions at that time included Iran, Crimea, Cuba, North Korea, and Syria.
GitHub confirmed that one of its determining factors for account restrictions is the IP address associated with a user’s activity — specifically, whether that IP address originates from a sanctioned region.
Collateral Restrictions: Developers Outside Sanctioned Countries Affected
The IP-based enforcement approach created problems beyond its intended targets. Duncan Worrell, a UK-based developer, reported that his private financial services company’s GitHub repository was blocked — despite the UK not being subject to any US trade sanctions. GitHub did not provide Worrell with an explanation for how this occurred.
Worrell offered his own assessment of the likely cause:
“A sub-contractor of a sub-contractor currently resident in Ukraine, accessed our GitHub repo while visiting family in Crimea.”
He elaborated further in an email to ZDNet:
“We did know two sub-contractors of our Latvian sub-contractor were not Latvian. That one may have been Ukrainian, but we had no knowledge that a) Crimea had been sanctioned or b) the developer had visited Crimea. Neither had made any source code changes since May this year, so any IP tracking would have been historical.”
Worrell also highlighted the difficulty of the appeals process, in which affected developers were required to upload government-issued identification to prove they were no longer in a sanctioned region:
“We also asked both developers to lodge individual appeals to prove they were no longer in Crimea. That requires their IDs (copy and selfie) be uploaded and at least one of them still has that registered to a Crimean address, despite now living in Kyiv, Ukraine. I don’t imagine people update their passport every time they move house. GitHub should really provide another option to proving residence.”
GitHub’s Official Explanation
Tyler Fuller, GitHub’s General Counsel at the time, acknowledged the inherent complexity of the situation in a public statement:
“Sanctions are complex and were originally designed to regulate trade in more traditional goods and services, especially financial products. For companies that provide certain types of digital services, compliance presents novel legal questions and involves some uncertainty.”
Fuller also stressed GitHub’s broader goal:
“We’re dedicated to both allowing as many developers around the world as possible to participate in the open-source community and to following the law.”
Key Takeaways for Development Teams
- IP-based enforcement has broad reach: GitHub’s use of IP geolocation means that any access to a repository from a sanctioned region — even a temporary visit by a contractor — can trigger a restriction on the entire repository or account.
- Supply chain risk: Organizations using distributed contractors or subcontractors should be aware that access from sanctioned regions, even without malicious intent, can result in service interruptions.
- Appeals process friction: The identity verification process required for appeals may be impractical for developers whose registered addresses differ from their current location — a common situation for people who have relocated.
- Legal ambiguity for digital services: US trade sanctions were primarily designed for physical goods and financial services. Their application to software platforms and open-source collaboration remains a legally evolving area.
- GitHub’s stated position: The company asserts it is doing the minimum required by law while trying to preserve access for as many developers as possible globally.
Broader Implications for Open Source
The incident raised important questions about the future of global open-source collaboration when hosted on platforms subject to national export control laws. Developers and organizations in unaffected countries may still find their work disrupted if any member of their supply chain — however remote — accesses shared resources from a sanctioned region. For teams with international contractors, this represents a compliance and operational risk that deserves explicit attention in project governance and contractor agreements.
Self-hosted or geographically distributed version control infrastructure (such as self-managed GitLab instances) may warrant consideration for teams with significant exposure to these risks, though they introduce their own operational overhead.