GitHub Account Restricted Over US Sanctions on Crimea

Anatoly Kashkin, a developer based in Crimea and maintainer of the open-source project GameHub, publicly disclosed in July 2019 that GitHub had restricted his account due to US economic sanctions. His announcement, posted directly on GitHub, read: “My GitHub account has been restricted due to US sanctions as I live in Crimea. I may not be able to continue maintaining GameHub in future.”

Kashkin reported that his personal website hosted on GitHub Pages returned a 404 error and that his private repositories had been disabled. He retained limited ability to create and delete public repositories, but his day-to-day workflow as an open-source maintainer was effectively disrupted.

The Sanctions Background

Russia annexed Crimea in 2014 following political upheaval in Ukraine. The United States and the European Union responded by imposing economic sanctions targeting individuals, energy companies, and organisations connected to the annexation. These sanctions have broad extraterritorial reach, requiring US-based companies — including technology providers — to restrict services to sanctioned regions.

GitHub’s own trade controls page acknowledged the policy change at the time, stating: “To comply with U.S. trade control laws, GitHub recently made some required changes to the way we conduct our services.” The company listed the affected regions as Crimea, Cuba, Iran, North Korea, and Syria.

For individual users in those regions not otherwise specifically designated, GitHub described the remaining access as: “limited access to GitHub public repository services for personal communications only.”

Wider Impact: Iranian Developers Also Affected

Kashkin’s case was not isolated. ZDNet reported at the same time that Iranian developers had been experiencing similar account restrictions from GitHub, drawing broader attention to how US trade law cascades through the global software ecosystem. Open-source contributors who have no political affiliation with sanctioned governments can find themselves caught in blanket enforcement applied by geography alone.

The Broader Tech Industry Context

The GitHub restrictions landed during a period of heightened scrutiny over technology and trade. In mid-2019, the Trump administration placed Huawei on the Entity List, temporarily preventing US companies from supplying it with components and software — a decision that was subsequently partially walked back. The pattern highlighted how trade policy had extended well beyond traditional goods into the digital infrastructure that software developers depend on daily.

The situation echoes earlier eras of US export control, when strong encryption and certain processor architectures were classified as munitions and subject to strict export licensing — a policy that shaped early internet cryptography standards significantly.

Alternatives Suggested — With Caveats

Community members pointed Kashkin toward alternatives such as GitLab and Bitbucket. However, both options carry their own complications for developers in sanctioned regions:

• GitLab — At the time, GitLab Inc. was a US-based company, meaning it could be subject to the same OFAC (Office of Foreign Assets Control) compliance obligations as GitHub.
• Bitbucket — Owned by Atlassian, an Australian company listed on the NASDAQ. Its US market ties could also expose it to similar trade control requirements.
• Self-hosting — Some community members suggested hosting a Git server in a jurisdiction with different regulatory posture, such as the Netherlands or Switzerland. This approach is technically viable but places significant operational burden on individual developers.
• Gitea or Forgejo — Lightweight, self-hostable, open-source Git services that can be run on any server globally, avoiding dependency on US-controlled platforms entirely.

What This Means for Open-Source Maintainers

The Kashkin case illustrates a structural tension in the modern open-source ecosystem: the dominant code hosting platforms are concentrated in the United States, which subjects them — and, by extension, their global user base — to US foreign policy decisions. A developer’s ability to collaborate, publish, and maintain software can be revoked based on their physical location, regardless of the nature of their work.

For DevOps teams and engineering organisations that rely on contributors from around the world, this is a supply-chain and community risk worth understanding. Key considerations include:

• Mirror critical repositories to self-hosted infrastructure or jurisdiction-diverse hosting as a contingency.
• Understand your contributors’ locations if your open-source project involves collaborators in potentially sanctioned regions — their access to shared tools is not guaranteed.
• Review your SaaS tool dependencies for US-company exposure if your team operates in or serves regions under active sanctions regimes.
• Follow OFAC guidance if your organisation operates at the intersection of software and international commerce — penalties for inadvertent sanctions violations can be severe.

The debate sparked by Kashkin’s post on Hacker News and across the developer community reflects a growing awareness that infrastructure is never politically neutral — and that open source, while global in aspiration, operates within very real jurisdictional constraints.