united-states sanctions
Why some US software companies ban their free products for some countries?
<p>I'm a developer from Iran and I know Iran is under US sanctions. I have a few questions.</p>

<p>First let me start with an example. If you reach <a href="https://hub.docker.com" rel="nofollow noreferrer">Docker Hub</a> website from Iran you get this message:</p>

<blockquote>
  <p>Since Docker is a US company, we must comply with US export control
  regulations. In an effort to comply with these, we now block all IP
  addresses that are located in Cuba, Iran, North Korea, Republic of
  Crimea, Sudan, and Syria...</p>
</blockquote>

<ol>
<li>If the product is a free software, does it count as exported goods?</li>
<li>Why some US companies ban their free software products and some don't? Aren't they under the same law?</li>
<li>Why sometimes a company bans some of their software products but not some others (all of them free)? For example Google does not allow Iranian users to download the Android SDK (or even read the Android docs) but they allow to download Google Chrome.</li>
<li>Why would US ban Iranian people from using free software products? Isn't the problem nuclear program and human rights? What does downloading a free software has to do with those?</li>
</ol>

<p>As a preface, every company must have a team of lawyers who interpret the rules and who know the practice of the Treasury Department, so that the company doesn't violate the rules and end up in big trouble. A company has to decide whether some action is worth the risk (meaning, knowing what is it worth to them, and what <em>are</em> the risks). There is a long <a href="https://www.treasury.gov/resource-center/faqs/Sanctions/Pages/faq_iran.aspx" rel="nofollow noreferrer">FAQ</a> from Treasury which tries to interpret the rules. A simple answer to the question is that a company might decide that the risk is too great, even if many or most specialists in the legal issues don't agree that there is an assumed risk.</p>

<p><a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=29f712e759d606aef2d781d9305a2d26&amp;mc=true&amp;node=se31.3.560_1204&amp;rgn=div8" rel="nofollow noreferrer">31 CFR 560.204</a> states:</p>

<blockquote>
  <p>Except as otherwise authorized pursuant to this part, and
  notwithstanding any contract entered into or any license or permit
  granted prior to May 7, 1995, the exportation, reexportation, sale, or
  supply, directly or indirectly, from the United States, or by a United
  States person, wherever located, of any goods, technology, or services
  to Iran or the Government of Iran is prohibited, including the
  exportation, reexportation, sale, or supply of any goods, technology,
  or services to a person in a third country undertaken with knowledge
  or reason to know that:</p>
  
  <p>(a) Such goods, technology, or services are intended specifically for
  supply, transshipment, or reexportation, directly or indirectly, to
  Iran or the Government of Iran; or</p>
  
  <p>(b) Such goods, technology, or services are intended specifically for
  use in the production of, for commingling with, or for incorporation
  into goods, technology, or services to be directly or indirectly
  supplied, transshipped, or reexported exclusively or predominantly to
  Iran or the Government of Iran.</p>
</blockquote>

<p>Reducing the verbiage, exportation of technology to Iran is prohibited. It is thus not a stretch to think that exporting technology to Iran is prohibited for a US person or company.</p>

<p>It is possible to obtain a license to export to or from Iran, see <a href="https://www.ecfr.gov/cgi-bin/retrieveECFR?gp=&amp;SID=29f712e759d606aef2d781d9305a2d26&amp;mc=true&amp;n=pt31.3.560&amp;r=PART&amp;ty=HTML#sp31.3.560.e" rel="nofollow noreferrer">31 CFR 560.501 ff.</a>. It is completely not clear what it takes to get a license: I suggests that differences between US companies may relate to whether a particular company has a license to export. There are also <a href="https://www.treasury.gov/ofac/downloads/sdnlist.txt" rel="nofollow noreferrer">prohibitions targeted at specific individuals and organizations</a>. Transactions over the internet can be risky, because a website cannot compel a user to truthfully identify themselves, and "E.O. 13599 requires U.S. persons to block all property and interests in property of the Government of Iran, unless otherwise exempt or authorized by OFAC", and absolute blocking is an extreme form of due diligence.</p>

<p>The political questions as to the wisdom of the sanctions are appropriate for Politics SE.</p>
