As Washington and Tehran clash in Vienna over reviving the 2015 nuclear deal, Iran continues to struggle under the weight of U.S. sanctions. Among them are restrictions that make it difficult for Iranians to access information and fast-changing technologies that much of the rest of the world takes for granted.

Over the years, Washington has issued exemptions for personal communications tools - such as applications for messaging, blogging and social networking - citing the U.S. interest in ensuring Iranians maintain access to the global Internet. Such exemptions do not include tools for business communications, which are wrapped up in Washington’s wide-reaching sanctions on Iran and its banking system.

But with more and more of life occurring online, and the murkiness of the distinction between how people communicate personally and for business, U.S. policies can in effect end up aiding Tehran’s mounting push to censor and surveil, analysts say.

U.S. sanctions are so far-reaching that they govern in large part what Internet services, software and hardware Iranians can import or use. Many companies, however, simply avoid working with Iranians rather than navigate the morass of compliance regulations.

That means that Iranians’ access to technology is limited, at a time when Iran’s hard-line government attempts to exercise even greater control over the Internet there. According to some analysts, U.S. policymakers have failed to keep up.

“These sanctions have forced the Iranian tech community to move their communication platforms and cloud services inside Iran, thereby making it easier for authorities to conduct surveillance and shut down the Internet during times of unrest,” said Holly Dagres, a senior fellow at the Atlantic Council, a Washington thank tank, and author of a report released Thursday documenting social media trends in Iran.

Some three-quarters of Iranians older than 18, out of a population of 84 million, use social media and messaging apps, according to a 2021 poll by the Iranian Students Polling Agency. But sanctions can mean limited access to some online services - and often affect most those without the financial means to afford VPNs and other temporary workarounds, said Dagres.

It is impossible, for example, to make purchases in the online Apple store with an Iranian address. Start-ups have popped up to sell Apple gift cards to Iranians with the financial means, said Mahsa Alimardani of Article 19, a London-based freedom of expression group. Slack, a mainstay of communication in many communities, remains unavailable, Alimardani said, while Iranians cannot create accounts on Amazon Web Services or use Google Cloud Platform, popular cloud hosting services.

What works one day may also not work the next, adding to daily uncertainties. With the country’s economy in shambles, Iranians seeking out information or educational opportunities in Web-based sectors such as gaming or coding can find themselves at a disadvantage.

For months, Iranians have been protesting water shortages, in person and online. Security forces have met the demonstrations with Internet clampdowns and violence, underscoring the challenges Iranians face in communicating with each other and the outside world.

Some had hoped that the Biden administration would ease or clarify tech-related sanctions - some of which have been in place for decades - as a goodwill gesture to Iran, after four years of the Trump administration’s maximum-pressure campaign, said Ali Vaez, director of the Iran project at the International Crisis Group, a Brussels-based think tank.

Instead, President Joe Biden prioritized negotiating a return to the 2015 deal, known as the Joint Comprehensive Plan of Action, which would grant Iranians relief from nuclear-related sanctions, leaving in place a host of other blacklists.

U.S. sanctions ban American citizens and companies from doing business with Iran, as well as non-U.S. citizens and firms that work in or with the United States. The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC, is charged with enforcing sanctions, as well as issuing licenses for exemptions, in consultation with other arms of the government.

It’s a balance of “ensuring the broadest possible information tools get to the people of Iran while at the same time guarding against tools, including software and hardware, that can be used by the Iranian government to target or otherwise censure the people of Iran,” said John E. Smith, who ran OFAC for 11 years, until 2018.

In 2009, after Iranian security forces violently suppressed massive pro-democracy demonstrations organized in part online, U.S. policymakers began considering how U.S. sanctions hindered Iranians’ access to Internet technology, Dagres said.

During the Obama administration, OFAC announced new guidelines and licenses - known as General License D and General License D-1 - that would permit companies to export more online services, software, browsers and other Internet tools to Iran. These changes were crafted to include social media giants Facebook, Twitter, Instagram and WhatsApp, which many blacklisted Iranian leaders use.

In the years since, however, Iran has advanced in developing its own National Internet Network, an alternative to the global Web that it can more easily censor and shut down.

“US sanctions are not the reason for Internet censorship in Iran - that onus falls on the Islamic Republic,” said Dagres.

Still, Iranian activists and digital rights groups have called for further changes and clarifications as “something that the United States can do to have some positive impact,” said Alimardani. New technology such as cloud-sharing services have taken off, for example, but their regulatory status remains unclear, Dagres said.

Companies are often then left to interpret what could be a sanctions violation or what might be exempt.

“The issue arises when the sanctions architecture becomes simply too complex for companies to easily understand what is permitted,” said Esfandyar Batmanghelidj, chief executive of the London-based Bourse & Bazaar Foundation, a think tank.

For example, some international tech companies rely on U.S.-based servers or the U.S. banking system for their operations, meaning their activities fall under Washington’s jurisdiction. Last year, OFAC fined a Swiss IT firm $7.8 million after it used U.S.-based servers to run part of a lost-baggage program it provided to blacklisted Iranian airliners.

A Treasury Department spokesman, who spoke on the condition of anonymity because of the sensitive nature of sanctions, said in an email that the “Treasury authorizes the export of certain services, software, and hardware incident to personal communications to Iran, including through Iran General License D-1” and other regulations, as “part of our commitment to ensure the Iranian people have access to the tools of personal communications.”

One U.S. tech company took on the challenge in 2019 and applied for a general OFAC license to operate in Iran. GitHub, a Web-based software-development platform and repository, finally received it two years later.

“We really do fundamentally believe that software development, software collaboration, promotes the free flow of information and communication,” Lynn Hashimoto, GitHub’s head of product and regulatory legal, said of the company’s decision. The license application process “was labor and resource-intensive.”

OFAC declined to comment on whether other companies have applied for similar exemptions.

“OFAC considers applications to provide communications tools to Iran that might fall outside the general license on a case-by-case basis, although we do not comment on specific licenses,” the OFAC spokesman said.

But with a precedent now set, GitHub said it has since applied for OFAC licenses to operate in U.S.-sanctioned Syria and Crimea, too.