US sanctions restrictions have traditionally exempted exchanges of information and informational materials. However, because the prohibitions on exports of software and services are sufficiently broad to cover the use of Internet-based communication methods and related software, the provision of many new communications platforms to customers in sanctioned countries remains prohibited. In recent years, the US government has worked to balance its economic sanctions regime with its desire to foster the free flow of information to and from persons in countries subject to comprehensive US sanctions.
In 2010, the Office of Foreign Assets Control ("OFAC") introduced general licenses authorizing provision of certain services and software incident to Internet-based communications. To qualify for these general licenses, however, such services and software must be publicly available at no cost to the user.
In March 2012, to further ensure that the sanctions on Iran do not have an unwanted chilling effect on the ability of companies to provide personal communications tools to individuals in that country, OFAC issued interpretive guidance as to the coverage of the general license in the case of Iran. OFAC provided an illustrative list of services and software that could be provided under the general license, including, among other things, Yahoo Messenger, Google Talk, Dropbox, Google Chrome, Firefox, Flash Player and Acrobat Reader. OFAC also indicated that certain services and software would still require specific authorization, but under a favorable licensing policy, including fee-based services and software such as web hosting, fee-based apps and fee-based mobile apps.
Compliance with OFAC’s sanctions regulations in these areas has been made more difficult by the ubiquity of the Internet and the reality that readily available proxy software can easily enable a person in a sanctioned country to appear to be located elsewhere. Nevertheless, the US government expects any person subject to its jurisdiction to take steps to prevent the exportation or re-exportation of non-exempted products and services to persons in countries subject to comprehensive US sanctions or that are otherwise on the US list of blocked persons. Non-US companies should note that the US authorities broadly construe their jurisdiction, taking the position, for example, that merely locating servers in the United States is sufficient to give them jurisdiction over a company.
It is against this background that on May 30, 2013, in order to further foster the free flow of information to individual Iranian citizens, OFAC issued General License D ("GL D"), which authorizes certain transactions otherwise prohibited under the Iranian Transactions and Sanctions Regulations ("ITSR"). This new guidance will be of particular interest to any company that provides its services via the Internet. GL D narrowly eases the restrictions on the exportation or re-exportation of certain services, software and hardware incident to personal communications over the Internet from the United States or by US persons, including entities owned or controlled by US persons and established or maintained outside the United States. GL D complements the previously issued general license provisions under the ITSR, which, subject to certain restrictions, authorize the exportation from the United States or by US persons to Iran of specified publicly available, no-cost services incident to the exchange of personal communications over the Internet, as well as the software necessary to enable such services.
Transactions Authorized by GL D
GL D authorizes the direct or indirect exportation or re-exportation to Iran of:
- Fee-based services pertaining to personal communications over the Internet, such as instant messaging, chat, email, social networking, media sharing, web browsing and blogging. This expands the prior license that permitted the same activities only on a free basis, with the possibility of specific licenses for fee-based activity. Under GL D, specific licenses may no longer be necessary for specified fee-based activity.
- Fee-based software necessary to enable the aforementioned so long as such software is classified under Export Control Classification Number ("ECCN") EAR99 or 5D992.c. These ECCN numbers relate to products, software or technology not specifically enumerated on the dual-use Commerce Control List ("CCL") or products, software or technology that are considered mass-market encryption.
- To the extent not covered by (1), specified personal consumer software and hardware classified under ECCN EAR99 or 4A994.b, 5A991.b.2, 5A991.b.4, 5A992.c and 5D992.c, and necessary related services enumerated in the Annex to GL D. The Annex includes, for example, the hardware and software related to certain mobile devices, satellite phones, personal computing devices, data storage devices, network systems, Internet connectivity services, telecom transmission facilities, radio equipment, anti-virus and anti-malware software, anti-censorship tools, anti-tracking tools, and residential satellite receivers, among other products.
- Consumer-grade Internet connectivity services and the provision, sale or leasing of capacity on telecommunications transmission facilities (such as satellite or terrestrial network connectivity) incident to personal communications.
According to GL D, specific licenses may be available, on a case-by-case basis, for services, software and hardware related to personal communications but not specified in GL D. Specific licenses require individual applications to OFAC. Funds transfers pertaining to the activities authorized by GL D may be processed by US depository institutions subject to specified restrictions.
Transactions Not Authorized by GL D
Similar to the personal communications general license regarding publicly available, no-cost services and software, GL D also does not authorize the direct or indirect exportation or re-exportation of services, software or hardware to the Government of Iran or to any blocked persons. GL D also does not authorize any export or re-export, directly or indirectly, of commercial-grade Internet connectivity services, telecom transmission facilities (such as dedicated satellite links or dedicated lines with quality-of-service guarantees), and domain name registration services or web hosting services for purposes other than personal communications. Finally, GL D does not authorize any other transactions otherwise prohibited by the ITSR.
GL D appears to reflect continuing US policy efforts to provide additional carve-outs from the otherwise comprehensive ITSR restrictions to better enable the Iranian people to communicate over the Internet. GL D is limited to specified items; it distinguishes between promoting personal communications as opposed to commercial activity in Iran, and explicitly prohibits transfers to the Government of Iran or to blocked parties. The distinction between personal communications and commercial activity may be hard to draw and even hard to police since software and services can have multiple uses. Reliance on GL D will therefore require careful vetting and internal procedures to ensure any services or transfers of hardware or software do not exceed its intended scope.