GitHub reaction is outrageously disproportionate. They should just prevent login from Iran. They had no basis for blocking a legitimate customer in Europe based on this.
Random? I think the problem with Paypal was that they do not warn or provide reasons for freezing. GH's reasons are clear.
> Blocking a whole European company not conducting business with Iran because one of its employee tried to login while there is not respecting the embargo, it's just overreach.
Says who? There is a law, the law is unclear and IHMO a bad law. The law is overreach. Blaming GH for shitty US laws is akin to killing the messenger.
Says the US Department of the Treasury, as mentioned in the Twitter thread further down:
> 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account?
> No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted.
from their "FAQs: Iran sanctions" page — https://home.treasury.gov/policy-issues/financial-sanctions/...
What I’m not sure at all is that github had the obligation to preventively block cases instead of the alternative to investigate high risk cases prior to block. As long as they had a sound Compliance process for determining sanction enforcement needs in a reasonable time it should be enough - though for sure more expensive than autoblock followed by non-specialized, non-time sensitive (for github!) customer service followup.
But I sure as hell can expect them to investigate before cutting service to a long-time customer.
Keep in mind that US Government agencies that administer sanctions laws (the Treasury, in this case) are the ones interpreting what these laws mean. See https://en.m.wikipedia.org/wiki/Chevron_U.S.A.,_Inc._v._Natu....
The same law you're stating.
https://home.treasury.gov/policy-issues/financial-sanctions/...
Which is par for the course for financial companies.
> its employee tried to login while there
Those two statements are incompatible with each other.
And blocking on the first login attempt is overreach. The system doesn't know if you are tourist, visitor or resident. So wait two weeks at least.
If GitHub freezes your account, this is obviously serious and can impact your business to a greater or lesser extent depending on what your business does. But the data is not lost, and you'll likely have a copy of at least some of it (the actual repos) and maybe all of it if you were being careful.
If Paypal freeze your account then any money in it is simply lost (and your loss is Paypal's gain!). There's no way you could keep a "backup" of that money even if you were being careful. It's completely incomparable.
While this is completely tangential to the current discussion, I feel compelled to inform you that that's not how it works. When Paypal freeze your account, your account is not deleted, you just can't do anything with it. The money on it obviously remains yours. You just have to convince them that your account should be unfrozen or wait the maximum duration you agreed to in Paypal ToS - 180 days - after which they have to hand it back to you.
https://home.treasury.gov/policy-issues/financial-sanctions/...
I suppose this implies that the employee is Iranian.
The U.S. sanctions are pretty aggressive, and I don't think preventing login from Iran is anywhere near enough to comply. The law is the problem here.
Sorry what??? I have family in India, but not because I'm Indian, I just have family there. I have family in Poland, not because I am Polish (well I am kind of, but not on paper). I have family in the UK, but I'm not British.
This is 2021, not Christopher Columbus times.
In 2021, people are still directly related to their parents, and the majority of citizens in most countries is indeed the local population.
They may of course have obtained American citizenship now, but we're talking in the context of crazy US sanctions on Iran here, which I think work on connection to Iran.
I don't think there should be any consequence to being Iranian, but I don't have a say in American politics.
[1] https://en.wikipedia.org/wiki/Internment_of_Japanese_America...
So, no, it's not merely a "sensible" assumption.
It's an assumption that carries collective trauma and negative connotations for many who's ancestors have experienced painful discrimination because of their ancestry.
> I don't think there should be any consequence to being Iranian, but I don't have a say in American politics.
No, you don't. But you do have a voice to ask critical and nuanced questions out loudly.
It's common sense that most people are from the same country their parents are from, given what we know about immigration.
Interning people based on predicting their behavior due to ancestry is a whole different ballgame.
The legal concept you're referring to is called "ius soli". The legal concept which serves as a basis to determine someone's allegiance by their ancestry is called "ius sanguinis". [1][2]
[1] https://en.wikipedia.org/wiki/Jus_soli [2] https://en.wikipedia.org/wiki/Jus_sanguinis
So, no, it's not "common sense" to make that assumption.
Moreover, there's also the concept of "right to return" in international law. Many nations have implemented this in their nationality laws in a way that extends surprisingly far.
For instance, if you're of Luxembourgish descent through the male line of your family, you could just claim Luxembourg citizenship - and by extension E.U. citizenship - under Article 7 of their nationality laws. Something which was recently pointed out on Reddit. Even if you weren't born in Luxembourg or never have set a foot in the E.U. proper. [3]
[3] https://www.reddit.com/r/YouShouldKnow/comments/izkwzk/ysk_t...
I'm pretty sure some people might be surprised to discover they have a right to citizenship in another nation simply because they took the time to dig into their ancestry, their history and nationality laws.
> Interning people based on predicting their behavior due to ancestry is a whole different ballgame.
Of course it is.
But, why discuss someone's citizenship or ancestry then if it - apparently - doesn't matter in this discussion at all?
The only other theory that explains why this person got his access revoked from Github because he visited Iran, regardless of the reasons why, nevermind his citizenship or his ancestry.
If citizenship and/or ancestry matters, as is seemingly implied but never voiced in this discussion, then bringing up the implications of how policies reflect on that assumption clearly is relevant given the historic perspective.
The common sense idea deals with the probability of someone (already born) being of a certain citizenship given their parents' location.
Different ideas.
> The legal concept which serves as a basis to determine someone's allegiance by their ancestry is called "ius sanguinis"
Not allegiance, citizenship. Different, but similar concept again.
Citizenship is always first determined at birth. This isn't relevant to the discussion.
> The common sense idea deals with the probability of someone (already born) being of a certain citizenship given their parents' location.
That would be "ius soli". As opposed to "ius sanguinis".
It's also not a "probability". These are principles which are formally enshrined in nationality laws and very much determine travel, migration and national security policies in different nations. Including the United States.
These are not "common sense" either.
These are laws which come with a long historical pedigree which includes identity politics, economic policies, moral and ideological values, and so on.
They are also very much subject to change through the dominant politics of the day.
> Not allegiance, citizenship. Different, but similar concept again.
I'm not willing to engage in a semantic discussion.
It depends on the countries' respective laws, but it's certainly possible that the person in question is not Iranian at all in terms of nationality as opposed to ancestory. As I recall, the law in question pertains to Iranian nationals, not those who happen to have Iranian ancestory.
"The United States has imposed an arms ban and an almost total economic embargo on Iran, which includes sanctions on companies doing business with Iran, a ban on all Iranian-origin imports, sanctions on Iranian financial institutions, ..."
A private visit is not doing business, so the org cannot be blocked. And most other companies are ignoring the US sanctions, that's why we have the current propaganda push.
The law is ok, because economical sanctions are the only way to get rogue nation states to comply. That's why we have sanctions on Iran, Russia, Crimes, North Korea. Unfortunately not against the US yet.