Update: After the publication of this piece and a subsequent outcry, Slack reversed its actions against some impacted accounts and apologised. Slack's statement can be found here. The original story follows below.
Like other sectors, technology and communication companies need to follow sanctions law. But in what could be a case of mistaken or over zealous enforcement, Slack has banned an Iranian academic living in Canada from its platform.
On Wednesday, Amir Abdi, a machine learning scientist at the University of British Columbia (UBC) in Canada tweeted “Slack closed my account today!” He also included a screenshot of an alleged message from Slack, laying out the company’s position on enforcing US sanctions, including prohibiting “unauthorized use” of its products in certain countries, including Iran.
Abdi added “I’m a PhD student in Canada with no teammates from Iran!” Abdi moved to Canada from Isfahan, Iran, and is the recipient of the prestigious Vanier scholarship.
"I wish they had 'at least' sent out a warning before taking such drastic action. I wonder what if I wake up one day and a tech giant decides to follow the same path," Abdi told Motherboard in an email.
But despite not being based in Iran, Slack still suspended his account. Motherboard also spoke to two other Slack users who were banned due to Slack's enforcement of sanctions law. Both of these people were also based outside of Iran; at least one may have traveled to the country in the last year.
A Slack spokesperson told Motherboard in a statement that “Slack complies with the U.S. regulations related to embargoed countries and regions. As such, we prohibit unauthorized Slack use in Cuba, Iran, North Korea, Syria and the Crimea region of Ukraine. For more information, please see the US Department of Commerce Sanctioned Destinations , The U.S. Department of Treasury website, and the Bureau of Industry and Security website.”
The spokesperson added that Slack determines these violations by banning users who use IP addresses from banned countries.
“Our systems may have detected an account and/or a workspace owner on our platform with an IP address originating from a designated embargoed country. If our systems indicate a workspace primary owner has an IP address originating from a designated embargoed country, the entire workspace will be deactivated,” the statement read.
Abdi told Motherboard he does not have any financial or professional relations with Iran. He added that he did travel to Iran a number of months ago, but was not sure if his Slack application connected from the country.
Regardless, experts say determining which users have violated based on IP address is not the best way to enforce sanctions.
“If they looked into the account, saw where they are employed/where their bank accounts are and realize there is no flow of money between Iran and US/Canada because of this login, they surely would have no reason to do this,” Mahsa Alimardani, a researcher with freedom of expression organisation Article 19 and a doctoral student at the Oxford Internet Institute, told Motherboard in an online chat.
Got a tip? You can contact Joseph Cox securely on Signal on +44 20 8133 5190, OTR chat on email@example.com, or email firstname.lastname@example.org.
“If they were blocking Iranians running Iranian businesses on Slack it would be one thing,” she added. “Apple blocking Iranian developers a couple years ago from uploading their apps was this case. But Apple never blocked Iranian developers living and working in the US [as far as I know].”
Google previously limited use of the Google App Engine in Iran, a tool used to circumvent censorship.
Slack also told Motherboard it does not differentiate between free and paid accounts: the same approach applies.
If the ban is a mistake, Adbi can appeal.
“If someone thinks any actions we took were done in error, we will review further,” Slack’s statement added.
Subscribe to our new cybersecurity podcast, CYBER.
Update: This piece has been updated to include additional context on Adbi not being sure if he connected to the Slack service during a trip to Iran earlier this year, and include that Motherboard spoke to other people that Slack banned. It has also been updated to include additional direct information from Abdi.