OFAC has issued Iran General License D-2 “General License with Respect to Certain Services, Software, and Hardware Incident to Communications”, which and expands on GL D-1 by increasing the list of covered software and services, and also including items offered at no cost (D-1 only covered fee-based offerings), among other changes.
There are also 3 new Frequently Asked Questions:
1089. Can persons seeking to export software, services, or hardware to Iran in support of internet freedom apply for a specific license from OFAC if the export is not authorized by GL D-2?
Yes, persons seeking to export items to Iran or conduct other activities in support of internet freedom in Iran that are not authorized by GL D-2 or other authorizations are encouraged to submit a specific license application to OFAC.
Released on 09/23/2022
1088. What are OFAC’s due diligence expectations for cloud-based service or software providers whose services and software support communication tools authorized by GL D-2?
A cloud-based service or software provider whose non-Iranian customers provide services or software to persons in Iran via the cloud may rely upon the authorization in GL D-2 to provide access to Iran, provided that such provider conducts due diligence based on information available to it in the ordinary course of business to confirm that the non-Iranian customer: (1) is not a person whose property and interests in property are blocked, except as authorized under paragraph (a)(6) of GL D-2; and (2) provides software and services that fall within one of the categories described in FAQ 1087, or otherwise involve activity authorized or exempt under the ITSR.
In instances where cloud-based services or software are used to support the exportation of services or software to Iran authorized under GL D-2, OFAC does not generally expect a cloud-based service or software provider to evaluate the ultimate end use or end user of the authorized software or services, provided the cloud-based provider conducts due diligence based on information available to it in the ordinary course of business. For example, if a cloud-based service or software provider supports non-Iranian customers providing access in Iran to news websites or Virtual Private Networks (VPNs) that fall within one of the categories described in FAQ 1087, the cloud-based service or software provider need not evaluate whether the provision of access via the cloud involving Iranian end users is related to communication. By contrast, if a U.S. cloud-based service or software provider supports non-Iranian customers providing certain enterprise management software to Iran, such as payroll management software, the cloud-based service or software provider would be expected to evaluate whether its support of the software is a prohibited export of software or services to Iran because payroll management software is not generally considered a qualifying software incident to communications.
Please note that GL D-2 does not authorize the importation into the United States of Iranian-origin software or the dealing in such software, including the hosting of Iranian-origin software on a mobile application store. Persons seeking to engage in such activity may submit applications for specific licenses to OFAC that describe the nature of the software and the Iranian developers involved.
Released on 09/23/2022
1087. Does Iran General License (GL) D-2 authorize the exportation of fee-based or no-cost cloud-based services and software to Iran that are used to support communications tools authorized by GL D-2?
Yes. Paragraph (a)(1) of GL D-2 authorizes the exportation to Iran of fee-based or no-cost cloud-based services incident to the exchange of communications over the Internet. In addition, paragraph (a)(2) of GL D-2 authorizes the exportation to Iran of cloud-based software that is incident to, or enables services incident to, communications over the Internet. Software exported under paragraph (a)(2) of GL D-2 either: (i) must be designated as EAR99 under the Export Administration Regulations, 15 CFR parts 730 through 774 (EAR), or classified under Export Control Classification Number (ECCN) 5D992.c; or (ii) if the software is not subject to the EAR because it is of foreign origin, must be the type of software that would be designated EAR99 or classified under ECCN 5D992.c if it were located in the United States.
For purposes of GL D-2, cloud-based services and software are determined to be incident to the exchange of communications over the Internet when they are used to support transactions authorized or exempt under the Iranian Transactions and Sanctions Regulations (ITSR), 31 CFR part 560, including the following categories of activities:
- instant messaging, chat, email, social networking, sharing of photos and movies, web browsing, blogging, social media platforms, collaboration platforms, video conferencing, e-gaming platforms, e-learning platforms, automated translation, web maps, and user authentication services;
- software and services listed in the categories (6) through (11) of the Annex of GL D-2, including anti-virus and anti-malware software, anti-tracking software, mobile operating systems and related software, anti-censorship tools and related software; Virtual Private Network (VPN) client software and related software; and provisioning and verification software for Secure Sockets Layers (SSL) certificates and related software, provided that the software meets the relevant conditions of GL D-2, including applicable export control classification-related criteria;
- transactions that are exempt from the prohibitions of the ITSR, including news outlets and media websites covered by the exemption for information or informational materials in section 560.206 of the ITSR; and
- other transactions authorized under the ITSR, such as transactions necessary and ordinarily incident to publishing authorized pursuant to section 560.538, transactions for the conduct of the official business of certain international organizations pursuant to section 560.539, the sale and exportation of agricultural commodities, medicine, medical devices, and certain software and services pursuant to section 560.530, and transactions authorized pursuant to any general or specific licenses issued under the ITSR.
Please note that paragraph (a)(1) of GL D-2 does not authorize the exportation of cloud-based services or software to the Government of Iran, except as specified in paragraph (a)(6) of GL D-2.
Released on 09/23/2022
And, something that is unusual for the issuing of a GL, both Treasury:
U.S. Treasury Issues Iran General License D-2 to Increase Support for Internet Freedom
September 23, 2022
WASHINGTON – Today, the U.S. Department of the Treasury issued Iran General License (GL) D-2 to increase support for internet freedom in Iran by bringing U.S. sanctions guidance in line with the changes in modern technology since the issuance of Iran GL D-1. On Wednesday, the Iranian government cut off access to the Internet for most of its 80 million citizens to prevent the world from watching its violent crackdown on peaceful protestors sparked by the brutal death of Mahsa Amini in the custody of Iran’s Morality Police. While Iran’s government is cutting off its people’s access to the global internet, the United States is taking action to support the free flow of information and access to fact-based information to the Iranian people. The updated guidance will authorize technology companies to offer the Iranian people with more options of secure, outside platforms and services.
“As courageous Iranians take to the streets to protest the death of Mahsa Amini, the United States is redoubling its support for the free flow of information to the Iranian people,” said Deputy Secretary of the Treasury Wally Adeyemo. “Today, Treasury is announcing the expansion of Iran General License D-2, which will expand the range of internet services available to Iranians. With these changes, we are helping the Iranian people be better equipped to counter the government’s efforts to surveil and censor them. In the coming weeks, OFAC will continue issuing guidance to support the Administration’s commitment to promoting the free flow of information, which the Iranian regime has consistently denied to its people.”
The expanded GL tackles the following key issues:
- Adds covered categories of software/services to include social media platforms, collaboration platforms, video conferencing, as well as cloud-based services in support of such services, as well as tools that incorporate communication functions and are often included with authorized items or services (e.g., online maps, e-gaming, e-learning platforms, automated translation, web maps, and user authentication services)
- Provides additional authorization for the services that support the communication tools to assist ordinary Iranians in resisting repressive internet censorship and surveillance tools deployed by the Iranian regime.
- GL D-2 continues to authorize anti-virus and anti-malware software; anti-tracking software; mobile operating systems and related software; anti-censorship tools and related software; Virtual Private Network (VPN) client software; and related software. These tools protect the ability of Iranians to engage in free expression and bravely resist regime oppression.
- Removes the requirement to verify communications are “personal” in nature, in line with similar licenses in other OFAC programs.
- For activity not covered by GL D-2, expands existing case-by-case licensing policy, particularly to allow Iranian developers to create homegrown anti-surveillance and anti-censorship apps, which many Iranian people rely upon to circumvent domestic internet controls.
Advancing the Free Flow of Information for the Iranian People
SEPTEMBER 23, 2022
Today we are issuing a General License to advance our efforts and commitments to ensure that the Iranian people can freely access information online. This update modernizes the Treasury Department license to expand the free flow of information and access to fact-based information to people in Iran consistent with the new ways people use the Internet today, especially the common communication activities of Iranians and use of the digital services. These steps will help counter the Iranian government’s efforts to surveil and censor its citizens. As a result of this expanded General License, technology firms will be able to provide more digital services to people in Iran, from access to cloud computing services to better tools to enhance their online security and privacy.
We are taking this step against a stark backdrop. The Iranian government has cut off access to the Internet for most of its 80 million citizens to prevent them — and the world — from watching its violent crackdown on peaceful protestors. It is clear that the Iranian government is afraid of its own people. Mahsa Amini is senselessly, tragically dead, and now the government is violently suppressing peaceful protesters rightly angry about her loss.
In the face of these steps, we are going to help make sure the Iranian people are not kept isolated and in the dark. This is a concrete step to provide meaningful support to Iranians demanding that their basic rights be respected.
issued press releases.