What Happened

In late July 2019, GitHub began restricting the accounts of developers located in countries subject to US trade sanctions. The Microsoft-owned platform confirmed it was taking action against users in Crimea, Cuba, Iran, North Korea, and Syria, in order to comply with US export control laws.

The restrictions were first brought to wider attention when a developer based in Crimea reported losing access to private GitHub repositories, and a developer based in Iran published a Medium post describing their account being restricted.

What Was Restricted

According to GitHub’s support documentation at the time, a restricted account means:

• Private repository services are suspended. Developers lose access to their private repos.
• Paid services are suspended. Any paid GitHub features or plans are disabled.
• Public repositories remain accessible worldwide and are not affected by the sanctions restrictions.
• Developers in affected regions retain only limited access to GitHub public repository services, permitted for personal communications and not for commercial purposes.

TechCrunch reported at the time that developers who need to store export-controlled data could continue to do so through GitHub’s enterprise server product, which is deployed on-premises rather than through GitHub’s hosted service.

GitHub CEO’s Statement

GitHub CEO Nat Friedman acknowledged the restrictions on Twitter, stating that the company had to implement new limits on private repos and paid accounts in Iran, Syria, and Crimea. He emphasized that this was not a voluntary business decision:

“We’re not doing this because we want to; we’re doing it because we have to. GitHub will continue to advocate vigorously with governments around the world for policies that protect software developers and the global open source community.”

Nat Friedman, GitHub CEO (July 2019)

GitHub also published a statement clarifying its position on compliance:

“GitHub is subject to U.S. trade control laws, and is committed to full compliance with applicable law. At the same time, GitHub’s vision is to be the global platform for developer collaboration, no matter where developers reside. As a result, we take seriously our responsibility to examine government mandates thoroughly to be certain that users and customers are not impacted beyond what is required by law. This includes keeping public repository services, including those for open source projects, available and accessible to support personal communications involving developers in sanctioned regions.”

GitHub official statement, July 2019

How Accounts Are Flagged

GitHub’s support page stated that account restrictions are determined based on IP addresses and payment histories — not nationality or ethnicity. This approach has practical implications:

• A developer visiting a sanctioned country could have their account temporarily restricted for the duration of that visit.
• Developers are explicitly not permitted to use VPNs to circumvent the restrictions.
• At least one developer who claimed to be based in Finland reportedly had their account restricted, suggesting IP-based detection can produce false positives.
• Developers who believe their account was restricted in error can appeal the decision through GitHub’s support process.

Access to Restricted Repository Data

One of the most significant concerns for affected developers was data access. At least one developer was told that GitHub was not legally able to provide an export of the disabled repository content. Friedman noted that GitHub did not believe it was legally able to provide advance notice before applying restrictions.

However, Friedman suggested a workaround: developers could make their private repositories public before restrictions took effect, allowing them to clone or access the content through GitHub’s publicly available services.

Open Questions at the Time

Several key questions were unresolved when the story broke:

• GitHub had previously stated that US export controls would not apply to its service in the context of sanctions against China. The company had not yet confirmed what changed or why a different approach was taken for the countries named in 2019.
• It was not publicly confirmed whether account restrictions were being applied automatically based on detection logic, or on a case-by-case basis through manual review.

Broader Implications for the Open Source Community

The incident highlighted a tension that affects many US-based technology platforms: the obligation to comply with US export control and sanctions law, and the goal of providing globally accessible developer infrastructure. For developers in sanctioned regions, reliance on US-hosted platforms for critical workflows — including CI/CD pipelines, private repositories, and collaboration tools — carries regulatory risk that is ultimately outside their control.

The event prompted broader discussion in the developer community about the risks of platform dependency and the importance of self-hosted or geographically distributed alternatives for teams operating in regions subject to international trade restrictions.

Key Takeaways

• GitHub restricted private repositories and paid services for developers in Iran, Crimea, Cuba, North Korea, and Syria in July 2019 to comply with US trade sanctions law.
• Public repositories and open source projects remained accessible worldwide.
• Restrictions are based on IP address and payment history, not nationality.
• Developers can appeal incorrect restrictions and can make private repos public to regain access to their code.
• VPN circumvention is explicitly prohibited under GitHub’s terms in this context.
• GitHub committed to advocating for developer-friendly government policies while maintaining legal compliance.