Google error message: “403. That’s an error. Your client does not have permission to get URL / from this server. That’s all we know.”

What We Can Learn from Google’s Approach to Sanctions on Iran

Despite the easing of secondary sanctions following the Nuclear Agreement signed in January 2016, American tech companies remain especially cautious about running afoul of the US Treasury. And it’s easy to see why: they seem to prohibit all transactions by default, except explicit exceptions defined by Office of Foreign Assets Control (OFAC) issued general licenses.

The Problem with Default Blocking

When it comes to (over)compliance with US sanctions, Google makes for an interesting case study. In 2013, OFAC issued a general license authorising the export of certain communications-related services, software and hardware to Iran. Google has since taken a number of positive steps. In 2013, it made Google Play accessible in Iran (though only for free apps with no in-app billing features). More recently, it made Google Authenticator accessible in Iran, not long after taking some criticism from civil society. Regardless of what prompted this change, it is welcome news as it offers Iranians a more secure means of setting up 2-factor authentication.

Despite these positive moves, Google could do more to mitigate the negative impact of sanctions on freedom of expression in Iran. The current default setting seems to be to block services, unless a page or service is specifically whitelisted. CafeBazaar CTO Reza Mohammadi argues Google should do this the other way around: blacklist specific pages or services to be blocked and allow access to everything else by default. Google could also be more transparent about which services are not available in Iran and why. This would save Iranians a good deal of time and frustration, as they currently have no way to know which services they won’t be able to access until they try to log on.

Reza Mohammadi (@remohammadi): “@CDA @aliborhani1 @alibangi But this whitelist behavior, pages are blocked unless otherwise, is against the values advertised by @JigsawTeam”

To get a sense of what issues remain today, we asked Iranian Twitter users for examples of Google services they are unable to access. Some examples of services users reported being unable to access include: Google Analytics, Google Adwords, Google Now, Google Play Developer Console, and Google Cloud. A cursory look at the hashtag #فناتحریم (“sanctions”) also turns up a number of complaints about restrictions on Google services. While this evidence is anecdotal, it coheres with empirical data from Small Media’s research on sanctions to suggest a troubling trend. It appears that concerns about the lingering impact of an opaque sanctions regime have led Google to block Iranians from a number of its services.

As things stand now, Google is a popular and trusted brand in Iran. But if Google doesn’t act to mitigate some of the negative impacts of sanctions, and clearly explain its position, it may erode this trust and prompt Iranians to start looking for alternatives.

Google bears responsibility for its excess of caution regarding compliance with export controls, but the US government could do more to clarify its position so as to give companies assurances that they can offer services in Iran without risk of being penalized. Marietje Schaake, Member of the European Parliament, raised this concern in May, noting that “The current lack of clarity surrounding American sanctions creates legal uncertainty for European businesses.”

Indeed, while it may be easy to criticize Google’s approach to sanctions compliance, the tech giant’s apprehensive disposition is understandable. The US government’s default position seems to largely prohibit trade involving Iran, with exceptions requiring explicit authorization. As an FAQ about the implementation of the nuclear agreement issued by the Treasury notes, “Even after Implementation Day, with limited exceptions, U.S. persons – including U.S. companies – continue to be broadly prohibited from engaging in transactions or dealings with Iran or its government.” Given that many large tech companies are based in the United States, these policies have implications for the accessibility of popular platforms inside Iran.

As we have seen, such broad legal restrictions are sometimes associated with a risk averse approach among tech companies. This can lead them to err on the side of caution and limit Iranians’ access to their services, which further restricts the flow of information in a country already beset by extensive censorship. Iranians face considerable internet restrictions from their government; the last thing they need is for Western companies to start piling on.