Slack 'bans users' who have visited US sanctioned countries | Hacker News Reader

Slack 'bans users' who have visited US sanctioned countries

bbc.co.uk

136 pointsfrereubu57 comments

Discussion from earlier today: https://news.ycombinator.com/item?id=18724107

That's a slightly different situation, though. The "original" article is about an Iranian national who now lives in Canada, while this "dupe" article covers both that case and multiple others with the claim that Slack is banning anyone who has ever visited one of the sanctioned countries.

I'm one of the people who got banned: https://twitter.com/aaomidi/status/1075621119028314112

Just FYI for everyone here, the US government explicitly allows instant messaging applications to be exempt from sanctions: https://www.treasury.gov/resource-center/sanctions/Programs/...

This is to foster more secure and wider internet access for Iranians.

Slack is generally B2B paid service for collaboration, is it not? You would imagine instant messaging and social networking to be something where Skype.com falls under the umbrella, but Lync/Skype for Business does not. The PDF also constantly uses the word personal.

> such as instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging. In order to qualify for that authorization, such services and software had to be publicly available (widely available to the public) at no cost to the user

I'm fairly certain that Slack is available for free usage; I think there's just a limit on the number of users you can have in your "organization" (where "organization" doesn't necessarily mean anything formal like a company) without needing to pay

Yes, sure, you can make a free workspace just like you can run a trial of Lync, but presumably this categorization brings them out of personal messaging and into a B2B-relationship for business purposes, and the majority of their business is funded by paid B2B contracts.

NB: I'm not saying this is fair to anyone and it's just my personal interpretation, but it reads to me that the OFAC PDF linked is overly intent on specifically personal messaging, for personal individuals, not for business collaboration, B2B contracts, anything related to work or commercialness

But Slack isn't strictly for businesses. It's "teams" in "workspaces" which could mean whatever. Especially in the case of free accounts there's a fair possibility that those could just be some people.

Indeed; I know of (and have joined) multiple Slack "organizations" that are just individuals chatting about things. Didn't cost me anything.

Slack's free tier doesn't limit number of team members, I'm in one with thousands. Slack's free tier limits the number of messages you can access to the most recent 10,000. There are also limits on the amount of storage, number of integrations with other services, and video calls can't be multi-party, only 1-to-1.

https://slack.com/plans

It is possible that they saw activity that made them slam a panic button or they were explicitly told by the US government to stop traffic; they've been working on this problem for a long time and this response strikes me as sudden.

The activity that they saw, I suspect, was the arrest of Meng Wanzhou. The C-suite wants to be absolutely sure it could never happen to them. The cheapest solution is to mine their extensive data on customers to exclude any hint of a possibly-infringing connection. Any more nuanced response that involves humans making judgements about individual cases would be orders of magnitudes more expensive.

This isnt about stopping traffic to /from Iran, it's about banning people who ever logged in from there even once.

Use protocols that are public domain and not some proprietary shit. IRC, E-Mail and Websites: They will remain long after Slack, Facebook and others are gone.

Mattermost, anyone? Its a libre Slack replacement, with additional functionalities.

We have Mattermost at work, a very traditional Skype For Business kinda place, and it's awesome!

Matrix is another great replacement. The devs also offer dedicated hosting for a much cheaper per user cost than slack.

I've been hosting a home Matrix server for around 6 months now and bridging my other services (hangouts, iMessage, SMS, and Slack) into it. As I slowly migrate away from those services I'll shut them down.

It is not perfect, particularly if you're using encryption, but everything I've had complaints about seems to be slowly but surely getting dealt with, and at this point it's actually a pretty solid experience with only a few bumps. In fact the thought of going back to having different applications, UIs, and devices to access my various communication channels seems ridiculous.

I really don't understand why slack is so popular. It's just irc, if you have a devops person they can stand that up over lunch, and send out the email to "hey download this app"

And Dropbox is trivially replaceable with rsync, yes?

I am not familiar with the state of rsync apps on Android and iOS. But for irc, yes it would easily replace slack.

Tell me about that NNTP-Hackernews gateway you’re posting from...

How is that any way relevant. A small single website integration with Usenet vs a general method of chat that is pretty much available on every single used device.

It‘s relevant because you are using HN, though Usenet news could do easily what HN does. Or can it?

It can do it better.

Chat bots & integrations...

Both of which exist in droves for IRC (hell, even Slack at one point had an IRC integration).

Things that existed for decades?

To be fair, it's often unclear what you need to do to comply w/ sanctions, and being found non-compliant can bring down some really heavy penalties.

Hint: Nothing unless you have proof. An IP is not enough because of VPNs or Proxies.

To be fair, no one ever went after Freenode over a desire to ban Iranians in Canada.

What you're saying seems to be along the lines of "It's a dumb law, don't blame slack." But to be fair, (heh) it's not like this mess was completely unforseen. There are censored/censorable forums and there are open ones. A lot of people knew the difference and warned us about this kind of thing.

You really can't compare freenode to slack, their scales are so vastly different that you're practically making a strawman.

That's... a fine response to a feature flame war. Fine fine, slack is better. IRC just doesn't compare. All of us using it are dinosaurs who should be forgotten. I'll grant all that stuff.

But real people are having their accounts banned simply because they've been to Iran (Or more worryingly, simply because they're Iranian; are european tourists getting banned? Seems like it's all expats in the article...)

You can't compare serious issues of censorship to platform flame wars. The moral scales are so vastly different that you're practically doing political censorship.

Companies can ask the federal agencies responsible for enforcing sanctions in advance whether particular actions are compliant or not. If you make a good faith effort to work with them they won't come down hard on you. Bureaucrats prefer cooperation rather than dealing with the hassle of enforcement; it's just less work for them.

But enforcement actions at this level always have a political twist to them. You can get permission one year, then a new person is appointed to head the agency or the sanctioned country does something. Now the permission you got last year isn't worth the paper it is printed on.

That's just not how it works. I defy you to show us a single case where a company was punished for a sanctions violation based on an action for which they previously received written approval. Federal judges don't tolerate that nonsense.

This.

Similarly, Google Cloud Platform blocks IPs from Iran, because I suspect they don't have a big-enough customer that pushes them to enable it. Some lazy-ass product counsel at Google does not have the balls to do the right thing and just decides to ban entire countries from accessing their customers' services because it's easier to be conservative.

Amazon, for example, operates in the same country and decides to interpret the law differently, despite being a bigger player. One more reason to not use Google Cloud.

(The irony is that the Iranian government is also fully aligned and likes to block things, so the poor people have to deal with the mess and circumvent blocking from both sides.)

I'd expect most of the population is using a VPN to access the internet now.

I haven't visited in about a decade so don't have a full picture. I'd say a lot of people have access to a VPN, but would not go as far as to say they are always connected to a VPN.

With a very broad interpretation you can be found guilty of breaking US sanctions when you have never even visited the US or are a US person. Every person in Iran is breaking US law with their daily shopping. It truly is absurd.

The emails they sent did not have any appeals process. They were also sent from no-reply addresses.

The worst thing about this isn't them blocking (even though they didn't need to). It was that they assumed their systems are 100% perfect and no one would need to appeal.

It was also the timing of this that was annoying. Right before long holidays (harder to get to your workplace and let people know what happened)

On Twitter, here is their standard language

> Our systems may have detected an account on our platform with an IP address originating from a designated embargoed country. Please send a note to feedback@slack.com so we can investigate further.

In general, they're also saying that,

> If you travel to an embargoed country, your account will not be deactivated if you attempt to use Slack. https://twitter.com/SlackHQ/status/1075924814530076675

I’ve seen the email sent to aaomidi, and it didn’t say that. It’s possible that they revised the notice after receiving complaints, but the initial batch was worded rather harshly without any indication that it was possible to appeal.

I'm a US citizen that used Slack briefly during a visit to Cuba and my accounts are still fine. Not sure how they are targeting people.

Can't they just block those countries at a firewall level?

This does seem like it'd be a much better solution... +1

There is alternative, use Hipchat.

Hipchat is discontinued. Was announced a while ago. Their official migration path is to move to Slack.

...

The State Department is a Slack user so there's that. https://apps.gov/products/Slack/

"In a statement to website Mashable, Slack said they "prohibit unauthorized Slack use in Cuba, Iran, North Korea, Syria and the Crimea region of Ukraine" to comply with US regulations."

Wait. What?

What are you confused by?

The company's interpretations of US regulations obviously.

Use is prohibited in those countries. The woman in the article reportedly created her account while in Cuba years ago (presumably before this policy?) and hasn't been back since.

She wasn't using Slack in Cuba when her account was cancelled.

You can't service them or have a business relationship with them per US law?

I can't get certificates for .ir domains signed, I can't add .ir domains to shared hosting providers, etc.

Apparently, you cannot ever have had a relationship with those countries.

This seems pretty straightforward. It is a violation of just about every competently written terms of service from a US company to transact business in these countries. For a complete list, see https://www.treasury.gov/resource-center/sanctions/SDN-List/... and https://www.treasury.gov/resource-center/sanctions/Programs/...

Specifically, section 560.540 of the ITR authorizes the exportation from the United States or by U.S. persons, wherever located, to persons in Iran of services incident to the exchange of personal communications over the Intemet, such as instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging, provided that such services are publicly available at no cost to the user. (ITR, section 560.540(a)(1).)

Reply on news.ycombinator.com