By Miriam Berger

The Washington Post

As Washington and Tehran clash in Vienna over reviving the 2015 nuclear deal, Iran continues to struggle under the weight of U.S. sanctions. Among them are restrictions that make it difficult for Iranians to access information and fast-changing technologies that much of the rest of the world takes for granted.

Over the years, Washington has issued exemptions for personal communications tools — such as applications for messaging, blogging and social networking — citing the U.S. interest in ensuring Iranians maintain access to the global Internet. Such exemptions do not include tools for business communications, which are wrapped up in Washington’s far-reaching sanctions on Iran and its banking system.

But with more and more of life occurring online, and the murkiness of the distinction between how people communicate personally and for business, U.S. policies can in effect end up aiding Tehran’s mounting push to censor and surveil, analysts say.

U.S. sanctions are so far-reaching that they govern in large part what Internet services, software and hardware Iranians can import or use. Many companies, however, simply avoid working with Iranians rather than navigate the morass of compliance regulations.

That means that Iranians’ access to technology is limited, at a time when Iran’s hard-line government is trying to exercise even greater control over the Internet there. According to some analysts, U.S. policymakers have failed to keep up.

“These sanctions have forced the Iranian tech community to move their communication platforms and cloud services inside Iran, thereby making it easier for authorities to conduct surveillance and shut down the Internet during times of unrest,” said Holly Dagres, a senior fellow at the Atlantic Council, a Washington thank tank, and author of a report released Thursday documenting social media trends in Iran.

Some three-quarters of Iranians older than 18, out of a population of 84 million, use social media and messaging apps, according to a 2021 poll by the Iranian Students Polling Agency. But sanctions can mean limited access to some online services — and often most affect those who lack the financial means to afford VPNs and other temporary workarounds, Dagres said.

It is impossible, for example, to make purchases in the online Apple store with an Iranian IP address. Start-ups have popped up to sell Apple gift cards to Iranians who can afford them, said Mahsa Alimardani of Article 19, a London-based freedom-of-expression group. Slack, a mainstay of communication in many communities, remains unavailable, Alimardani said, and Iranians cannot create accounts on Amazon Web Services or use Google Cloud Platform, two popular cloud hosting services.

What works one day also may not work the next, adding to daily uncertainties. With the country’s economy in shambles, Iranians seeking out information or educational opportunities in Web-based sectors such as gaming or coding can find themselves at a disadvantage.

For months, Iranians have been protesting water shortages, in person and online. Security forces have met the demonstrations with Internet clampdowns and violence, underscoring the challenges Iranians face in communicating with one another and the outside world.

Some had hoped that the Biden administration would ease or clarify tech-related sanctions — some of which have been in place for decades — as a goodwill gesture to Iran after four years of the Trump administration’s maximum-pressure campaign, said Ali Vaez, the director of the Iran project at the International Crisis Group, a Brussels-based think tank.

Instead, President Biden prioritized negotiating a return to the 2015 nuclear deal, known as the Joint Comprehensive Plan of Action, which would grant Iranians relief from nuclear-related sanctions, leaving in place a host of other blacklists.

U.S. sanctions ban American citizens and companies from doing business with Iran; likewise banned are non-U.S. citizens and firms that work in or with the United States. The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC, is charged with enforcing sanctions, as well as issuing licenses for exemptions, in consultation with other arms of the U.S. government.

The sanctions program is aimed at “ensuring the broadest possible information tools get to the people of Iran while at the same time guarding against tools, including software and hardware, that can be used by the Iranian government to target or otherwise censure the people of Iran,” said John E. Smith, who ran OFAC for 11 years, until 2018.

In 2009, after Iranian security forces violently suppressed massive pro-democracy demonstrations organized in part online, U.S. policymakers began considering how American sanctions hindered Iranians’ access to Internet technology, Dagres said.

During the Obama administration, OFAC announced new guidelines and licenses— known as General License D and General License D-1 — that would permit companies to export more online services, software, browsers and other Internet tools to Iran. These changes were crafted to include social media giants Facebook, Twitter, Instagram and WhatsApp, which many blacklisted Iranian leaders use.

In the years since, however, Iran has advanced in developing its own National Internet Network, an alternative to the global Web that it can more easily censor and shut down.

“U.S. sanctions are not the reason for Internet censorship in Iran — that onus falls on the Islamic republic,” Dagres said.

Still, Iranian activists and digital rights groups have called for further changes and clarifications as “something that the United States can do to have some positive impact,” Alimardani said. New technology such as cloud-sharing services have taken off, for example, but their regulatory status remains unclear, Dagres said.

Companies outside Iran are often then left to interpret what could be a sanctions violation or what might be exempt.

“The issue arises when the sanctions architecture becomes simply too complex for companies to easily understand what is permitted,” said Esfandyar Batmanghelidj, the chief executive of the London-based Bourse & Bazaar Foundation, a think tank.

For example, some international tech companies rely on U.S.-based servers or the U.S. banking system for their operations, meaning their activities fall under Washington’s jurisdiction. Last year, OFAC fined a Swiss IT firm $7.8 million after it used U.S.-based servers to run part of a lost-baggage program it provided to blacklisted Iranian airlines.

A Treasury Department spokesman, who spoke on the condition of anonymity because of the sensitive nature of the sanctions issue, said in an email that the “Treasury authorizes the export of certain services, software, and hardware incident to personal communications to Iran, including through Iran General License D-1” and other regulations as “part of our commitment to ensure the Iranian people have access to the tools of personal communications.”

One U.S. tech company took on the challenge in 2019 and applied for a general OFAC license to operate in Iran. GitHub, a Web-based software-development platform and repository, finally received it two years later.

“We really do fundamentally believe that software development, software collaboration, promotes the free flow of information and communication,” Lynn Hashimoto, GitHub’s head of product and regulatory legal, said of the company’s decision. The license application process “was labor- and resource-intensive.”

OFAC declined to comment on whether other companies have applied for similar exemptions.

“OFAC considers applications to provide communications tools to Iran that might fall outside the general license on a case-by-case basis, although we do not comment on specific licenses,” the OFAC spokesman said.

But with a precedent set, GitHub said it has since applied for OFAC licenses also to operate in U.S.-sanctioned Syria and Crimea, the Ukrainian territory annexed by Russia.

Miriam Berger is a staff writer reporting on foreign news for The Washington Post from Washington, D.C. Before joining The Post in 2019 she was based in Jerusalem and Cairo and freelance reported around the Middle East, as well as parts of Africa and Central Asia.