What Happened

In late July 2019, GitHub began restricting the accounts of developers located in countries subject to US trade sanctions. The Microsoft-owned platform confirmed it was taking action against users in Crimea, Cuba, Iran, North Korea, and Syria, in order to comply with US export control laws.

The restrictions were first brought to wider attention when a developer based in Crimea reported losing access to private GitHub repositories, and a developer based in Iran published a Medium post describing their account being restricted.

What Was Restricted

According to GitHub’s support documentation at the time, a restricted account means:

• Private repository services are suspended. Developers lose access to their private repos.
• Paid services are suspended. Any paid GitHub features or plans are disabled.
• Public repositories remain accessible worldwide and are not affected by the sanctions restrictions.
• Developers in affected regions retain only limited access to GitHub public repository services, permitted for personal communications and not for commercial purposes.

TechCrunch reported at the time that developers who need to store export-controlled data could continue to do so through GitHub’s enterprise server product, which is deployed on-premises rather than through GitHub’s hosted service.

GitHub CEO’s Statement

GitHub CEO Nat Friedman acknowledged the restrictions on Twitter, stating that the company had to implement new limits on private repos and paid accounts in Iran, Syria, and Crimea. He emphasized that this was not a voluntary business decision:

“We’re not doing this because we want to; we’re doing it because we have to. GitHub will continue to advocate vigorously with governments around the world for policies that protect software developers and the global open source community.”

Nat Friedman, GitHub CEO (July 2019)

GitHub also published a statement clarifying its position on compliance:

“GitHub is subject to U.S. trade control laws, and is committed to full compliance with applicable law. At the same time, GitHub’s vision is to be the global platform for developer collaboration, no matter where developers reside. As a result, we take seriously our responsibility to examine government mandates thoroughly to be certain that users and customers are not impacted beyond what is required by law. This includes keeping public repository services, including those for open source projects, available and accessible to support personal communications involving developers in sanctioned regions.”

GitHub official statement, July 2019

How Accounts Are Flagged

GitHub’s support page stated that account restrictions are determined based on IP addresses and payment histories — not nationality or ethnicity. This approach has practical implications:

• A developer visiting a sanctioned country could have their account temporarily restricted for the duration of that visit.
• Developers are explicitly not permitted to use VPNs to circumvent the restrictions.
• At least one developer who claimed to be based in Finland reportedly had their account restricted, suggesting IP-based detection can produce false positives.
• Developers who believe their account was restricted in error can appeal the decision through GitHub’s support process.

Access to Restricted Repository Data

One of the most significant concerns for affected developers was data access. At least one developer was told that GitHub was not legally able to provide an export of the disabled repository content. Friedman noted that GitHub did not believe it was legally able to provide advance notice before applying restrictions.

However, Friedman suggested a workaround: developers could make their private repositories public before restrictions took effect, allowing them to clone or access the content through GitHub’s publicly available services.

Open Questions at the Time

Several key questions were unresolved when the story broke:

• GitHub had previously stated that US export controls would not apply to its service in the context of sanctions against China. The company had not yet confirmed what changed or why a different approach was taken for the countries named in 2019.
• It was not publicly confirmed whether account restrictions were being applied automatically based on detection logic, or on a case-by-case basis through manual review.

Broader Implications for the Open Source Community

The incident highlighted a tension that affects many US-based technology platforms: the obligation to comply with US export control and sanctions law, and the goal of providing globally accessible developer infrastructure. For developers in sanctioned regions, reliance on US-hosted platforms for critical workflows — including CI/CD pipelines, private repositories, and collaboration tools — carries regulatory risk that is ultimately outside their control.

The event prompted broader discussion in the developer community about the risks of platform dependency and the importance of self-hosted or geographically distributed alternatives for teams operating in regions subject to international trade restrictions.

Key Takeaways

• GitHub restricted private repositories and paid services for developers in Iran, Crimea, Cuba, North Korea, and Syria in July 2019 to comply with US trade sanctions law.
• Public repositories and open source projects remained accessible worldwide.
• Restrictions are based on IP address and payment history, not nationality.
• Developers can appeal incorrect restrictions and can make private repos public to regain access to their code.
• VPN circumvention is explicitly prohibited under GitHub’s terms in this context.
• GitHub committed to advocating for developer-friendly government policies while maintaining legal compliance.

Overview

In late July 2019, Microsoft-owned GitHub began restricting accounts belonging to developers located in countries subject to US trade sanctions. The move affected users in regions listed on GitHub’s US trade controls page — Crimea, Cuba, Iran, North Korea, and Syria — and triggered a broader debate about the impact of geopolitical compliance obligations on open-source software development and developer access.

The Incident That Sparked the Debate

The situation gained public attention when Anatoliy Kashkin, a 21-year-old Russian citizen living in Crimea, reported that GitHub had notified him his account had been “restricted due to US trade controls.” Kashkin used GitHub to host his personal website and to develop GameHub, an open-source game launcher for Linux that aggregates titles from Steam, GOG, and Humble Bundle into a single interface.

The restriction posed a practical problem beyond simple inconvenience. While his website could be migrated to any alternative hosting provider, GameHub had accumulated an established user base and contributor community on GitHub. Kashkin noted that discoverability and issue tracking — both central to open-source project health — would suffer significantly if the project were forced off the platform.

“GitHub has many useful features and it’s safe to assume that many people interested in GameHub already use GitHub. Discoverability is also a very important factor. I don’t think many people will find GameHub on a self-hosted server somewhere.”

— Anatoliy Kashkin, GameHub developer

How GitHub’s Restrictions Work

GitHub’s trade controls policy distinguishes between its cloud-hosted service (GitHub.com) and its on-premises enterprise product. According to GitHub’s own documentation at the time:

• GitHub.com (cloud): Restricted for users in sanctioned regions. Individual users in those countries could, in limited cases, retain access to public repository services for personal communications only.
• GitHub Enterprise Server (on-premises): Not subject to the same geographic restrictions, making it a potential alternative for enterprise users in affected regions.
• Export control compliance: GitHub reminded users that they are individually responsible for ensuring their code and data comply with US Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR).

GitHub did offer an appeals process for account restrictions, but Kashkin told ZDNet the process was not viable in his case. To lift the restriction, GitHub required proof that he did not live in Crimea — which he could not provide, as he is a Russian citizen with Crimean registration who has lived there his entire life.

Iran Also Affected

Kashkin was not alone. Iranian developer Hamed Saeedi posted publicly — on Medium — describing how GitHub had blocked his account despite his having used the platform since 2012. The notification he received mirrored Kashkin’s:

“Due to U.S. trade control law restrictions, your GitHub account has been restricted. For individual accounts, you may have limited access to free GitHub public repository services for personal communications only.”

— GitHub account restriction email, as reported by Hamed Saeedi

Saeedi’s Medium post, titled “GitHub blocked my account and they think I’m developing nuclear weapons,” drew widespread attention to what appeared to be a broad, automated restriction applied to Iranian accounts, regardless of the nature of the developer’s work.

Why US Trade Sanctions Apply to GitHub

GitHub operates as an online service and is therefore subject to US Office of Foreign Assets Control (OFAC) regulations. As a company incorporated in the United States and owned by Microsoft, it must comply with sanctions that restrict the provision of services — including software and cloud hosting — to entities in designated countries or territories.

At the time of these reports, GitHub stated it was in discussions with US regulators to explore how it might expand access for developers in affected regions while remaining compliant with the law.

Alternatives and Their Limitations

Fellow developers suggested that Kashkin and others in similar positions consider alternative Git hosting services. The two most commonly cited were:

• GitLab: Headquartered in the United States, and therefore potentially subject to the same OFAC compliance requirements.
• Bitbucket (Atlassian): Founded in Australia, but listed on the US NASDAQ exchange since 2015, which may bring similar legal obligations.

Self-hosted alternatives — such as a privately run Gitea or GitLab CE instance — are not subject to US service-provider sanctions in the same way, but they sacrifice the discoverability, community tooling, and network effects that make platforms like GitHub valuable for open-source projects.

Wider Implications for Open-Source Communities

The restrictions highlighted a tension that the open-source community had not been forced to confront at scale before: the fundamental principles of open collaboration and free access to code sit uneasily alongside the export-control frameworks that govern US-based technology platforms.

For developers in sanctioned regions, losing access to dominant platforms like GitHub means more than losing a code host. It affects:

• Project visibility: The ability for others to discover, star, fork, or contribute to a project.
• Issue tracking and collaboration: Communication with contributors and users through issues and pull requests.
• CI/CD integration: Automated pipelines tied to GitHub Actions or third-party services connected to GitHub repositories.
• Package distribution: Some ecosystems use GitHub as a primary distribution channel for libraries and tools.

GitHub’s Subsequent Actions

Following public pressure in 2019 and into 2020, GitHub took steps to expand access for developers in Iran and other affected regions — particularly for open-source projects — while remaining within the bounds of US law. However, the specific scope and timeline of those changes fall outside the events described in this article and should be verified against current GitHub policy documentation.

Key Takeaways for DevOps Teams

• If your organization employs contractors or contributors located in OFAC-sanctioned regions, your GitHub-based workflows may be disrupted unexpectedly.
• Open-source maintainers should consider whether their project’s reliance on a single US-based platform creates single points of failure for international contributors.
• Enterprises operating in or hiring from affected regions should evaluate self-hosted or multi-region source control strategies as part of their vendor risk assessments.
• GitHub’s on-premises Enterprise Server product was specifically cited as a potential alternative for teams that need control over geographic access restrictions.

Original reporting by ZDNet, July 2019. GitHub had been contacted for comment at the time of original publication.

GitHub Account Restricted Over US Sanctions on Crimea

Anatoly Kashkin, a developer based in Crimea and maintainer of the open-source project GameHub, publicly disclosed in July 2019 that GitHub had restricted his account due to US economic sanctions. His announcement, posted directly on GitHub, read: “My GitHub account has been restricted due to US sanctions as I live in Crimea. I may not be able to continue maintaining GameHub in future.”

Kashkin reported that his personal website hosted on GitHub Pages returned a 404 error and that his private repositories had been disabled. He retained limited ability to create and delete public repositories, but his day-to-day workflow as an open-source maintainer was effectively disrupted.

The Sanctions Background

Russia annexed Crimea in 2014 following political upheaval in Ukraine. The United States and the European Union responded by imposing economic sanctions targeting individuals, energy companies, and organisations connected to the annexation. These sanctions have broad extraterritorial reach, requiring US-based companies — including technology providers — to restrict services to sanctioned regions.

GitHub’s own trade controls page acknowledged the policy change at the time, stating: “To comply with U.S. trade control laws, GitHub recently made some required changes to the way we conduct our services.” The company listed the affected regions as Crimea, Cuba, Iran, North Korea, and Syria.

For individual users in those regions not otherwise specifically designated, GitHub described the remaining access as: “limited access to GitHub public repository services for personal communications only.”

Wider Impact: Iranian Developers Also Affected

Kashkin’s case was not isolated. ZDNet reported at the same time that Iranian developers had been experiencing similar account restrictions from GitHub, drawing broader attention to how US trade law cascades through the global software ecosystem. Open-source contributors who have no political affiliation with sanctioned governments can find themselves caught in blanket enforcement applied by geography alone.

The Broader Tech Industry Context

The GitHub restrictions landed during a period of heightened scrutiny over technology and trade. In mid-2019, the Trump administration placed Huawei on the Entity List, temporarily preventing US companies from supplying it with components and software — a decision that was subsequently partially walked back. The pattern highlighted how trade policy had extended well beyond traditional goods into the digital infrastructure that software developers depend on daily.

The situation echoes earlier eras of US export control, when strong encryption and certain processor architectures were classified as munitions and subject to strict export licensing — a policy that shaped early internet cryptography standards significantly.

Alternatives Suggested — With Caveats

Community members pointed Kashkin toward alternatives such as GitLab and Bitbucket. However, both options carry their own complications for developers in sanctioned regions:

• GitLab — At the time, GitLab Inc. was a US-based company, meaning it could be subject to the same OFAC (Office of Foreign Assets Control) compliance obligations as GitHub.
• Bitbucket — Owned by Atlassian, an Australian company listed on the NASDAQ. Its US market ties could also expose it to similar trade control requirements.
• Self-hosting — Some community members suggested hosting a Git server in a jurisdiction with different regulatory posture, such as the Netherlands or Switzerland. This approach is technically viable but places significant operational burden on individual developers.
• Gitea or Forgejo — Lightweight, self-hostable, open-source Git services that can be run on any server globally, avoiding dependency on US-controlled platforms entirely.

What This Means for Open-Source Maintainers

The Kashkin case illustrates a structural tension in the modern open-source ecosystem: the dominant code hosting platforms are concentrated in the United States, which subjects them — and, by extension, their global user base — to US foreign policy decisions. A developer’s ability to collaborate, publish, and maintain software can be revoked based on their physical location, regardless of the nature of their work.

For DevOps teams and engineering organisations that rely on contributors from around the world, this is a supply-chain and community risk worth understanding. Key considerations include:

• Mirror critical repositories to self-hosted infrastructure or jurisdiction-diverse hosting as a contingency.
• Understand your contributors’ locations if your open-source project involves collaborators in potentially sanctioned regions — their access to shared tools is not guaranteed.
• Review your SaaS tool dependencies for US-company exposure if your team operates in or serves regions under active sanctions regimes.
• Follow OFAC guidance if your organisation operates at the intersection of software and international commerce — penalties for inadvertent sanctions violations can be severe.

The debate sparked by Kashkin’s post on Hacker News and across the developer community reflects a growing awareness that infrastructure is never politically neutral — and that open source, while global in aspiration, operates within very real jurisdictional constraints.