# Track 06: Glossary — Terminology, Standards, Regulations & Certifications

## Source Manifest

| source_id | url | bucket | last_checked | author/host | one-line note |
|-----------|-----|--------|--------------|-------------|---------------|
| T06-S001 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-appeal-and-reinstatement | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub reinstatement/appeal definitions) |
| T06-S002 | https://docs.github.com/en/site-policy/other-site-policies/github-and-trade-controls | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub trade controls policy) |
| T06-S003 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub AUP violation categories) |
| T06-S004 | https://docs.github.com/en/site-policy/other-site-policies/github-government-takedown-policy | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub government takedown) |
| T06-S005 | https://docs.github.com/en/site-policy/content-removal-policies/dmca-takedown-policy | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub DMCA policy) |
| T06-S006 | https://docs.github.com/en/site-policy/content-removal-policies/guide-to-submitting-a-dmca-counter-notice | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (DMCA counter-notice guide) |
| T06-S007 | https://docs.github.com/en/site-policy/github-terms/github-terms-of-service | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub ToS) |
| T06-S008 | https://transparencycenter.github.com/appeals/ | surrogate_primary | 2026-05-23 | GitHub Transparency Center | vendor docs (appeal statistics) |
| T06-S009 | https://ofac.treasury.gov/sanctions-programs-and-country-information/where-is-ofacs-country-list-what-countries-do-i-need-to-worry-about-in-terms-of-us-sanctions | verified_primary | 2026-05-23 | ofac.treasury.gov | OFAC sanctioned countries official list |
| T06-S010 | https://sanctionssearch.ofac.treas.gov/ | verified_primary | 2026-05-23 | ofac.treasury.gov | SDN list search tool |
| T06-S011 | https://ofac.treasury.gov/sanctions-list-service | verified_primary | 2026-05-23 | ofac.treasury.gov | Sanctions List Service official |
| T06-S012 | https://www.federalregister.gov/documents/2022/12/21/2022-27564/addition-of-general-licenses-for-the-official-business-of-the-united-states-government-and-certain | verified_primary | 2026-05-23 | federalregister.gov | 50 Percent Rule interpretive update |
| T06-S013 | https://www.federalregister.gov/documents/2022/10/13/2022-22233/publication-of-iranian-transactions-and-sanctions-regulations-web-general-license-d-2 | verified_primary | 2026-05-23 | federalregister.gov | GL D-2 Iran internet communications |
| T06-S014 | https://www.bis.gov/regulations/ear/734 | verified_primary | 2026-05-23 | bis.gov | EAR Part 734 scope |
| T06-S015 | https://www.bis.gov/ear/title-15/subtitle-b/chapter-vii/subchapter-c/part-734/ss-7344-de-minimis-us-content | verified_primary | 2026-05-23 | bis.gov | EAR de minimis rule |
| T06-S016 | https://www.law.cornell.edu/cfr/text/31/560.210 | surrogate_primary | 2026-05-23 | law.cornell.edu | vendor docs (OFAC exempt transactions; informational materials) |
| T06-S017 | https://www.congress.gov/crs-product/R46751 | verified_primary | 2026-05-23 | congress.gov | CRS Section 230 overview |
| T06-S018 | https://digital-strategy.ec.europa.eu/en/policies/digital-services-act | surrogate_primary | 2026-05-23 | ec.europa.eu | vendor docs (DSA official EU Commission) |
| T06-S019 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (GitHub 2FA) |
| T06-S020 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/countries-where-sms-authentication-is-supported | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (SMS country support list) |
| T06-S021 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (account recovery) |
| T06-S022 | https://www.loc.gov/item/global-legal-monitor/2020-10-08/china-government-releases-provisions-on-unreliable-entity-list-regime/ | verified_primary | 2026-05-23 | loc.gov | China Unreliable Entity List provisions |
| T06-S023 | https://www.wilmerhale.com/en/insights/client-alerts/20201021-chinas-new-export-control-law | surrogate_primary | 2026-05-23 | wilmerhale.com | vendor docs (China Export Control Law analysis) |
| T06-S024 | https://www.china-briefing.com/doing-business-guide/china/company-establishment/pipl-personal-information-protection-law | surrogate_primary | 2026-05-23 | china-briefing.com | vendor docs (PIPL compliance guide) |
| T06-S025 | https://opensource.guide/legal/ | surrogate_primary | 2026-05-23 | opensource.guide | vendor docs (open source legal guide) |
| T06-S026 | https://www.linuxfoundation.org/blog/navigating-global-regulations-and-open-source-us-ofac-sanctions | surrogate_primary | 2026-05-23 | linuxfoundation.org | vendor docs (协会; OFAC and open source) |
| T06-S027 | https://www.eff.org/issues/cda230 | surrogate_primary | 2026-05-23 | eff.org | vendor docs (协会; EFF Section 230 explainer) |
| T06-S028 | https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/china | surrogate_primary | 2026-05-23 | cms.law | vendor docs (China data protection overview) |
| T06-S029 | https://github.blog/news-insights/policy-news-and-insights/how-github-protects-developers-from-copyright-enforcement-overreach/ | surrogate_primary | 2026-05-23 | github.blog | vendor docs (GitHub DMCA enforcement philosophy) |
| T06-S030 | https://sanctionsnews.bakermckenzie.com/ofac-issues-updated-iran-general-license-related-to-certain-services-software-and-hardware-for-communications-over-the-internet-and-new-related-faqs/ | surrogate_primary | 2026-05-23 | bakermckenzie.com | vendor docs (GL D-2 analysis) |
| T06-S031 | https://nationalsecurity.law.georgetown.edu/publication/united-states-expands-sanctions-authorization-of-internet-based-activities-in-wake-of-protests-in-iran/ | surrogate_primary | 2026-05-23 | georgetown.edu | vendor docs (GL D-2 academic analysis) |
| T06-S032 | https://www.chinalawtranslate.com/en/export-control/ | surrogate_primary | 2026-05-23 | chinalawtranslate.com | vendor docs (China Export Control Law full translation) |
| T06-S033 | https://transparencycenter.github.com/government/ | surrogate_primary | 2026-05-23 | github.com | vendor docs (GitHub government takedown transparency) |
| T06-S034 | https://blog.lyc8503.net/en/post/github-account-suspended/ | surrogate_primary | 2026-05-23 | blog.lyc8503.net | vendor docs (first-person suspension account; practitioner) |
| T06-S035 | https://www.dlapiper.com/en-us/insights/publications/2020/09/china-unreliable-entity-list-provisions-fighting-fire-with-fire | surrogate_primary | 2026-05-23 | dlapiper.com | vendor docs (UEL legal analysis) |
| T06-S036 | https://secureframe.com/blog/ear-vs-itar | surrogate_primary | 2026-05-23 | secureframe.com | vendor docs (EAR vs ITAR comparison) |
| T06-S037 | https://ofac.treasury.gov/faqs/4 | verified_primary | 2026-05-23 | ofac.treasury.gov | OFAC FAQ on exemptions and licenses |
| T06-S038 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication | surrogate_primary | 2026-05-23 | docs.github.com | vendor docs (2FA configuration) |

## Overview

- **Platform terminology (GitHub)**: 23 terms
- **US sanctions law (OFAC/BIS/ITAR)**: 19 terms
- **Internet platform governance**: 12 terms
- **Open source licensing and compliance**: 10 terms
- **Account security**: 10 terms
- **China-related legal terminology**: 9 terms
- **Outsider pitfalls (shibboleth)**: 10 items
- **Total: 93 terms + 10 outsider pitfalls = 103 entries**

---

## Category 1: GitHub Platform Terminology

### 1.1 Account Suspension
- **Insider definition**: The most severe enforcement action. GitHub completely disables the account: profile returns 404 to visitors, all repos (public and private) become inaccessible, git push returns 403 Forbidden, OAuth tokens are revoked, GitHub Pages go offline. The owner can still view their own profile when logged in but cannot interact. Only GitHub T&S can lift it. evidence: [T06-S001] [T06-S003] [T06-S034]
- **Outsider misconception**: Confuse with "restriction" (lighter) or think it is temporary by default. It is indefinite until successful appeal.
- **Mispackaged?**: No. The term is precise and well-documented.

### 1.2 Account Flagging
- **Insider definition**: A lighter enforcement state where the account is marked for review. The user can still log in, but certain features are limited: cannot authorize new OAuth apps, some API actions are throttled, profile may show a warning. Often triggers SMS phone verification requirement. evidence: [T06-S003] [T06-S020]
- **Outsider misconception**: Think "flagged" = "suspended." Flagged accounts retain login access; suspended ones do not.
- **Mispackaged?**: No.

### 1.3 Account Restriction
- **Insider definition**: A middle-tier enforcement: the account exists and is accessible, but specific capabilities are removed (e.g., cannot create public repos, cannot interact with certain repos, rate-limited on API). Often applied to accounts in sanctioned regions where GitHub provides limited free services. evidence: [T06-S002]
- **Outsider misconception**: Equate restriction with suspension. A restricted account can still clone public repos and read content.
- **Mispackaged?**: No.

### 1.4 Reinstatement
- **Insider definition**: The formal process where a user seeks to regain access to a suspended/restricted account by acknowledging the violation and agreeing to comply going forward. Requires submitting the Appeal and Reinstatement form. Distinct from Appeal (which disputes the violation). evidence: [T06-S001]
- **Outsider misconception**: Think reinstatement = appeal. They are two separate tracks with different standards of review.
- **Mispackaged?**: No.

### 1.5 Appeal
- **Insider definition**: A user disputes that a violation occurred and provides evidence that a different decision should be reached. If the original reviewer would deny the appeal, an independent reviewer conducts a second review. All decisions are human-made, not automated. evidence: [T06-S001] [T06-S008]
- **Outsider misconception**: Think appeal is just "asking nicely." It requires factual evidence and has a 6-month window.
- **Mispackaged?**: No.

### 1.6 Reinstatement Form
- **Insider definition**: The specific web form at support.github.com/contact/reinstatement used for both reinstatement and appeal submissions. If the account is fully suspended and the user cannot log in, there is a separate form at /contact/cannot_sign_in. evidence: [T06-S001]
- **Outsider misconception**: Think they need to email GitHub directly. The form is the official channel.
- **Mispackaged?**: No.

### 1.7 Trust & Safety (T&S)
- **Insider definition**: GitHub's internal team responsible for enforcing Terms of Service, Acceptable Use Policies, and trade controls. They review flagged/suspended accounts, process appeals, and handle DMCA/government takedown requests. Response time is typically 1-3 business days. evidence: [T06-S001] [T06-S003]
- **Outsider misconception**: Think GitHub Support and T&S are the same team. Support handles billing/technical; T&S handles policy enforcement.
- **Mispackaged?**: No.

### 1.8 Terms of Service (ToS)
- **Insider definition**: The master legal agreement governing use of GitHub.com. Violations trigger enforcement actions from warnings to account termination. Key sections relevant to suspension: acceptable use, payment terms, intellectual property, account requirements. evidence: [T06-S007]
- **Outsider misconception**: Think ToS is only about code licensing. It covers conduct, payment, data use, and more.
- **Mispackaged?**: No.

### 1.9 Acceptable Use Policies (AUP)
- **Insider definition**: The subset of GitHub policies defining prohibited conduct: spam, malware distribution, ban evasion, impersonation, cryptocurrency mining, phishing, harassment, and coordinated inauthentic activity. Violations here are the most common trigger for account suspension. evidence: [T06-S003]
- **Outsider misconception**: Think AUP only covers "illegal content." It also covers automated bulk activity, fake accounts, and disruptive behavior.
- **Mispackaged?**: No.

### 1.10 DMCA Takedown
- **Insider definition**: A copyright holder sends a formal notice under the Digital Millennium Copyright Act requesting removal of infringing content. GitHub removes or disables access to the specified content (not the entire account, unless repeat infringer). The repository owner is notified and has the option to file a counter-notice. evidence: [T06-S005] [T06-S029]
- **Outsider misconception**: Confuse DMCA takedown with account suspension. DMCA targets specific content, not the account itself (unless repeat infringer policy applies).
- **Mispackaged?**: Yes, sometimes used as a threat to force account-level action when only repo-level is warranted.

### 1.11 DMCA Counter-Notice
- **Insider definition**: A formal response filed under penalty of perjury by a user whose content was removed via DMCA takedown. The user must have "a good faith belief that the material was removed or disabled as a result of mistake or misidentification." GitHub waits 10-14 business days after receiving a counter-notice and then re-enables the content, unless the copyright owner initiates legal action. evidence: [T06-S006]
- **Outsider misconception**: Think counter-notice is just "disagreeing." It is a sworn legal document with perjury consequences.
- **Mispackaged?**: No.

### 1.12 Government Takedown
- **Insider definition**: An official government request to remove content deemed unlawful under local law. GitHub reviews each request, applies geographic blocking when possible (limiting removal to the requesting jurisdiction), and publishes requests in the github/gov-takedowns repository. Distinct from DMCA (copyright) and ToS (platform rules) enforcement. evidence: [T06-S004] [T06-S033]
- **Outsider misconception**: Think government takedown = account ban. It usually targets specific repos/content, not accounts.
- **Mispackaged?**: No.

### 1.13 Ban Evasion
- **Insider definition**: Creating a new account to circumvent a suspension or restriction on an existing account. Explicitly prohibited under GitHub AUP. GitHub detects ban evasion via IP, device fingerprinting, payment info, and behavioral patterns. Attempting ban evasion typically results in permanent suspension of both the old and new accounts with no appeal. evidence: [T06-S003]
- **Outsider misconception**: Think creating a new account is a viable workaround. It is the single fastest path to permanent, non-appealable suspension.
- **Mispackaged?**: No.

### 1.14 Spam Flagging / Abuse Flagging
- **Insider definition**: Automated or manual flagging of accounts exhibiting spam behavior (bulk follows, automated starring, mass issue creation, phishing links). Flagged accounts enter review by T&S. evidence: [T06-S003]
- **Outsider misconception**: Think being flagged for spam is a ban. It is a review trigger, not a final decision.
- **Mispackaged?**: No.

### 1.15 Rate Limiting
- **Insider definition**: GitHub imposes API rate limits (5,000 requests/hour for authenticated users, 60/hour unauthenticated). Exceeding limits results in 403/429 responses. Distinct from account-level restrictions. Relevant to suspension because sanctioned-region accounts may face additional rate constraints. evidence: [T06-S002] [T06-S007]
- **Outsider misconception**: Think rate limiting means they are suspended. It is a normal platform mechanic.
- **Mispackaged?**: No.

### 1.16 OAuth App Revocation
- **Insider definition**: When an account is flagged or suspended, all OAuth app authorizations are revoked. Third-party apps lose access immediately. On reinstatement, re-authorization is required. evidence: [T06-S003]
- **Outsider misconception**: Think they can still use third-party tools after flagging. They cannot.
- **Mispackaged?**: No.

### 1.17 Organization Ban vs Individual Ban
- **Insider definition**: GitHub can suspend an individual account or an entire organization. Organization suspension affects all members' access to org repos, but does not suspend individual member accounts. An individual suspension does not automatically suspend the orgs they belong to (unless they are the sole owner). evidence: [T06-S001] [T06-S003]
- **Outsider misconception**: Think org suspension = all members banned. It only blocks access to org resources.
- **Mispackaged?**: No.

### 1.18 Repository Action vs Account Action
- **Insider definition**: GitHub can take action at repository level (disable, archive, make private, remove) without affecting the account, or at account level (flag, restrict, suspend) which affects all repos. DMCA and government takedowns are typically repo-level. ToS/AUP violations can be either. evidence: [T06-S003] [T06-S005]
- **Outsider misconception**: Assume repo removal means account suspension. They are independent.
- **Mispackaged?**: No.

### 1.19 403 Forbidden (Suspension Indicator)
- **Insider definition**: The HTTP status code returned when a suspended account tries to push, create PRs, or interact via API. The response body typically contains "Your account has been suspended" or similar. This is the first signal most developers encounter that their account is suspended. evidence: [T06-S034]
- **Outsider misconception**: Think 403 is a generic permission error. In the suspension context, it is definitive.
- **Mispackaged?**: No.

### 1.20 GitHub Support Ticket
- **Insider definition**: The official channel for communicating with GitHub about account issues. Created via support.github.com. For suspended accounts, the reinstatement form is the primary intake. Response SLA is 1-3 business days for free accounts; Enterprise/paid accounts may get faster response. evidence: [T06-S001]
- **Outsider misconception**: Think DMing @github on Twitter or posting in community discussions will resolve suspension. Only official support tickets are actionable.
- **Mispackaged?**: No.

### 1.21 GitHub Enterprise Exceptions
- **Insider definition**: GitHub Enterprise Cloud and Server are subject to the same trade control restrictions as github.com. However, Enterprise customers have dedicated account managers and may get faster T&S review. Enterprise Server self-hosted instances are classified under ECCN 5D992.c. Enterprise does NOT exempt an account from OFAC sanctions compliance. evidence: [T06-S002]
- **Outsider misconception**: Think Enterprise accounts are immune to sanctions. They are not.
- **Mispackaged?**: Yes, sometimes marketed as if Enterprise provides special legal protection.

### 1.22 npm/Packages Scope Impact
- **Insider definition**: When a GitHub account is suspended, any npm packages published under that account's scope become inaccessible. Downstream projects depending on those packages via `@scope/package` will fail to install. The packages are not deleted but are frozen in place. evidence: [T06-S003] [T06-S007]
- **Outsider misconception**: Think their published packages are safe from suspension impact. They are not.
- **Mispackaged?**: No.

### 1.23 GitHub Actions Billing Freeze
- **Insider definition**: When an account is suspended, GitHub Actions workflows stop running and billing is frozen. On reinstatement, accumulated charges (if any) are reconciled. Pending workflows do not resume; they must be re-triggered. evidence: [T06-S003] [T06-S007]
- **Outsider misconception**: Think Actions will keep running during suspension. They will not.
- **Mispackaged?**: No.

## Category 2: US Sanctions Law Terminology (OFAC / BIS / ITAR)

### 2.1 OFAC (Office of Foreign Assets Control)
- **Insider definition**: An agency of the US Treasury Department that administers and enforces economic and trade sanctions programs. OFAC is the primary regulator whose sanctions lists determine whether GitHub must restrict an account. OFAC operates on a strict-liability standard: intent to violate is not required for a violation to occur. evidence: [T06-S009] [T06-S011]
- **Outsider misconception**: Think OFAC is a law. It is an agency that enforces multiple sanctions programs established by Executive Orders and statutes.
- **Mispackaged?**: No.

### 2.2 SDN List (Specially Designated Nationals and Blocked Persons)
- **Insider definition**: OFAC's primary sanctions list. Individuals and entities on the SDN list have their US-nexus assets blocked, and US persons (including US companies like GitHub) are generally prohibited from any transactions with them. An SDN's GitHub account will be suspended. The list is updated frequently. evidence: [T06-S010] [T06-S011]
- **Outsider misconception**: Think the SDN list is only for "terrorists." It includes narcotics traffickers, human rights abusers, proliferators, and individuals/entities supporting sanctioned regimes.
- **Mispackaged?**: No.

### 2.3 SSI List (Sectoral Sanctions Identifications)
- **Insider definition**: A separate OFAC list targeting specific sectors of sanctioned economies (e.g., Russian energy, finance, defense sectors). Unlike SDN, SSI restrictions are narrower: they prohibit specific types of transactions (new debt, new equity) rather than a complete block. Less commonly triggers GitHub suspension than SDN. evidence: [T06-S011]
- **Outsider misconception**: Confuse SSI with SDN. SSI is sector-specific and less severe.
- **Mispackaged?**: No.

### 2.4 Executive Order (EO) — Sanctions-Related
- **Insider definition**: The legal instrument by which the US President establishes sanctions programs. Each sanctions program (Iran, Russia, DPRK, etc.) is authorized by one or more EOs. GitHub's trade controls page references EOs indirectly through OFAC programs. Key EOs include EO 13224 (terrorism), EO 13694 (cyber), EO 13662 (Russia). evidence: [T06-S009] [T06-S012]
- **Outsider misconception**: Think sanctions are "laws passed by Congress." Most are established by Executive Order under emergency powers.
- **Mispackaged?**: No.

### 2.5 50 Percent Rule (OFAC)
- **Insider definition**: Any entity owned 50% or more (individually or in aggregate) by one or more SDN-listed persons is itself treated as blocked, even if the entity is not named on the SDN list. This is critical for GitHub because an organization account controlled by an SDN-owned entity would be blocked. evidence: [T06-S012]
- **Outsider misconception**: Think only explicitly listed entities are blocked. The 50 Percent Rule extends blocking by ownership.
- **Mispackaged?**: No.

### 2.6 General License (GL)
- **Insider definition**: A blanket authorization published by OFAC that allows a defined category of transactions without requiring individual application. For GitHub, the most important GL is the Iran GL (General License D-2), which authorizes providing internet communication services (including cloud/SaaS like GitHub) to persons in Iran. No application needed if the activity falls within GL scope. evidence: [T06-S013] [T06-S030] [T06-S037]
- **Outsider misconception**: Think "license" means they need to apply individually. General Licenses are self-executing.
- **Mispackaged?**: No.

### 2.7 Specific License (SL)
- **Insider definition**: A written authorization issued by OFAC in response to a formal application for a specific transaction that would otherwise be prohibited. Required when no General License covers the activity. GitHub obtained a specific license to offer cloud services to developers in Iran before GL D-2 expanded coverage. Processing time is typically 90-180 days. evidence: [T06-S037]
- **Outsider misconception**: Think they can just "get an OFAC license" quickly. Specific Licenses take months and require detailed justification.
- **Mispackaged?**: No.

### 2.8 General License D-2 (GL D-2)
- **Insider definition**: Issued September 2022, replacing GL D-1. Authorizes export/reexport of internet communication services and software to Iran, including cloud-based services, collaboration platforms, video conferencing, e-learning, web browsing, and user authentication services. Critically, GL D-2 removed the "personal communications" requirement, allowing commercial/professional use. This is the legal basis for GitHub's restored Iran access. evidence: [T06-S013] [T06-S030] [T06-S031]
- **Outsider misconception**: Think GitHub's Iran access is a corporate goodwill decision. It is enabled by a specific OFAC General License.
- **Mispackaged?**: No.

### 2.9 OFAC Civil Monetary Penalty
- **Insider definition**: OFAC can impose civil penalties for sanctions violations on a strict-liability basis (no intent required). Maximum penalties can exceed $300,000 per violation or twice the value of the transaction, whichever is greater. This is why GitHub (and Microsoft) take sanctions compliance extremely seriously. evidence: [T06-S009] [T06-S037]
- **Outsider misconception**: Think sanctions violations only matter if "intentional." Strict liability means accidental violations are still punishable.
- **Mispackaged?**: No.

### 2.10 BIS (Bureau of Industry and Security)
- **Insider definition**: An agency of the US Department of Commerce that administers Export Administration Regulations (EAR). BIS controls dual-use items (commercial items with potential military application). Relevant to GitHub because GitHub Enterprise Server is classified under ECCN 5D992.c, and the platform itself may involve controlled technology transfers. evidence: [T06-S014] [T06-S002]
- **Outsider misconception**: Confuse BIS (export controls on dual-use items) with OFAC (sanctions on countries/persons). They are different agencies with different legal frameworks.
- **Mispackaged?**: No.

### 2.11 EAR (Export Administration Regulations)
- **Insider definition**: The body of regulations (15 CFR Parts 730-774) administered by BIS governing the export, reexport, and transfer of dual-use and certain commercial items. The EAR uses the Commerce Control List (CCL) and Export Control Classification Numbers (ECCN) to categorize items. GitHub Enterprise Server falls under ECCN 5D992.c. evidence: [T06-S014] [T06-S002]
- **Outsider misconception**: Think EAR only applies to physical goods. It covers software, technology, and technical data.
- **Mispackaged?**: No.

### 2.12 ITAR (International Traffic in Arms Regulations)
- **Insider definition**: Regulations administered by the State Department's DDTC controlling export of defense articles and services on the US Munitions List (USML). GitHub.com explicitly states it "is not designed for the hosting of ITAR-controlled data." ITAR violations carry higher penalties than EAR. evidence: [T06-S002] [T06-S036]
- **Outsider misconception**: Think ITAR is irrelevant to software. Software with defense applications (encryption for military comms, weapons guidance code) can be ITAR-controlled.
- **Mispackaged?**: No.

### 2.13 Country/Region-Based vs Individual-Based Sanctions
- **Insider definition**: OFAC sanctions can be comprehensive (targeting an entire country — Cuba, Iran, DPRK, Syria) or targeted/list-based (specific individuals/entities on SDN/SSI anywhere in the world). GitHub applies both: location-based restrictions for comprehensive sanctions countries and individual account blocks for SDN-listed persons. evidence: [T06-S009] [T06-S002]
- **Outsider misconception**: Think only "banned countries" matter. Individual SDN listings can block a developer in any country.
- **Mispackaged?**: No.

### 2.14 De Minimis Rule (EAR)
- **Insider definition**: Foreign-made items containing US-origin controlled content below a threshold percentage (10% or 25% depending on destination and item) are exempt from EAR. However, there is NO de minimis exemption for items destined to Country Group E:1/E:2 (embargoed destinations) or for 9x515/"600 series" items. evidence: [T06-S015]
- **Outsider misconception**: Think de minimis means "a little US content is always OK." The threshold varies and sometimes does not apply at all.
- **Mispackaged?**: No.

### 2.15 Deemed Export
- **Insider definition**: Under EAR, releasing controlled technology to a foreign national inside the United States is "deemed" to be an export to that person's home country. Relevant to GitHub because collaborative code review with a foreign national on controlled technology could constitute a deemed export. evidence: [T06-S014]
- **Outsider misconception**: Think export controls only apply when something crosses a border. Deemed export means a conversation in a US office can trigger them.
- **Mispackaged?**: No.

### 2.16 ECCN (Export Control Classification Number)
- **Insider definition**: The alphanumeric code assigned to items on the Commerce Control List. GitHub Enterprise Server and Copilot are classified as ECCN 5D992.c (information security software, mass market). This classification determines licensing requirements by destination. evidence: [T06-S002] [T06-S014]
- **Outsider misconception**: Think ECCN is optional or self-assigned. It is a regulatory classification with legal consequences.
- **Mispackaged?**: No.

### 2.17 Sanctioned Countries/Regions (as of 2026)
- **Insider definition**: GitHub restricts accounts based in Crimea, the separatist areas of Donetsk/Luhansk, Cuba, Iran, North Korea, and Syria. Russia and Belarus are in EAR Country Group E:2 with significant restrictions. CRITICAL: China is NOT a comprehensively sanctioned country, though specific Chinese entities/persons may be on the SDN or Entity List. evidence: [T06-S002] [T06-S009]
- **Outsider misconception**: Think China is a "sanctioned country" like Iran. It is not. Chinese developers are flagged due to VPN IP coincidence with sanctioned regions, not because China is sanctioned.
- **Mispackaged?**: Yes, commonly mispackaged in developer forums as "GitHub bans China."

### 2.18 Informational Materials Exemption
- **Insider definition**: Under OFAC regulations (31 CFR 560.210), the import/export of "information and informational materials" is exempt from sanctions prohibitions, regardless of format. Open-source code is generally considered informational materials. However, this exemption does NOT cover services (like providing paid cloud hosting) or custom code creation for sanctioned persons. evidence: [T06-S016] [T06-S026]
- **Outsider misconception**: Think "open source is exempt from all sanctions." The exemption covers passive receipt of code, not active service provision.
- **Mispackaged?**: No.

### 2.19 OFAC Compliance Program
- **Insider definition**: OFAC strongly encourages (and in practice requires for financial institutions) a risk-based compliance program including: (1) management commitment, (2) risk assessment, (3) internal controls, (4) testing and auditing, (5) training. GitHub's internal compliance program determines how accounts are screened and flagged. evidence: [T06-S009] [T06-S037]
- **Outsider misconception**: Think compliance is optional for tech companies. Any US company providing services globally needs an OFAC compliance program.
- **Mispackaged?**: No.

## Category 3: Internet Platform Governance Terminology

### 3.1 Content Moderation
- **Insider definition**: The practice of screening, reviewing, and taking action on user-generated content (and accounts) to enforce platform policies. GitHub's content moderation encompasses ToS/AUP enforcement, DMCA processing, government takedown review, and trade controls screening. GitHub publishes moderation statistics in its Transparency Center. evidence: [T06-S003] [T06-S008]
- **Outsider misconception**: Think content moderation is only about "censorship." It includes spam filtering, malware removal, and sanctions compliance.
- **Mispackaged?**: No.

### 3.2 Deplatforming
- **Insider definition**: The complete removal of a user's ability to use a platform. In the GitHub context, account suspension is a form of deplatforming. Unlike social media deplatforming (primarily about speech), GitHub deplatforming affects a developer's code, CI/CD pipelines, package distribution, and professional identity. evidence: [T06-S003] [T06-S034]
- **Outsider misconception**: Think deplatforming only happens to "bad actors." Sanctions-based deplatforming can affect innocent developers in the wrong geography.
- **Mispackaged?**: No.

### 3.3 Intermediary Liability
- **Insider definition**: The legal question of whether a platform (intermediary) is liable for content posted by its users. In the US, Section 230 provides broad immunity. In the EU, the DSA creates conditional liability. GitHub navigates both regimes: US law for its US operations, DSA for EU users. evidence: [T06-S017] [T06-S018]
- **Outsider misconception**: Think platforms are either "liable for everything" or "liable for nothing." The reality is a complex conditional framework.
- **Mispackaged?**: No.

### 3.4 CDA Section 230
- **Insider definition**: Section 230 of the Communications Decency Act (47 USC 230) provides that "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." This is GitHub's primary legal shield for hosting user-generated code. The Good Samaritan provision (230(c)(2)) further protects platforms that voluntarily moderate content in good faith. evidence: [T06-S017] [T06-S027]
- **Outsider misconception**: Think Section 230 means platforms "can do anything." It shields from third-party content liability, not from the platform's own actions or federal criminal law.
- **Mispackaged?**: No.

### 3.5 Safe Harbor (DMCA)
- **Insider definition**: Under 17 USC 512, online service providers that comply with DMCA notice-and-takedown procedures are shielded from copyright liability for content uploaded by users. GitHub qualifies by maintaining a designated agent, promptly removing infringing content upon notice, and implementing a repeat infringer policy. Distinct from CDA 230 safe harbor. evidence: [T06-S005] [T06-S017]
- **Outsider misconception**: Confuse DMCA safe harbor with CDA 230. They are separate statutes protecting against different types of liability.
- **Mispackaged?**: No.

### 3.6 Digital Services Act (DSA, EU)
- **Insider definition**: EU Regulation 2022/2065 establishing a comprehensive framework for platform accountability. Requires transparency reporting, statement of reasons for content/account actions, out-of-court dispute resolution, and data access for researchers. GitHub, if classified as a VLOP (Very Large Online Platform, 45M+ EU monthly users), faces enhanced obligations including systemic risk assessments. EU users have DSA-specific appeal rights beyond GitHub's own 6-month window. evidence: [T06-S018] [T06-S001]
- **Outsider misconception**: Think the DSA is "just another GDPR." It specifically targets content moderation and platform accountability, not data protection.
- **Mispackaged?**: No.

### 3.7 NetzDG (Netzwerkdurchsetzungsgesetz)
- **Insider definition**: Germany's 2017 Network Enforcement Act, requiring social media platforms with 2M+ German users to remove "manifestly unlawful" content within 24 hours. NetzDG was a precursor to the EU DSA and has been partially superseded by it. Relevant to GitHub because Germany is a major developer market and some repos have been subject to NetzDG-adjacent requests. evidence: [T06-S018]
- **Outsider misconception**: Think NetzDG still operates independently. It has been largely subsumed by the DSA.
- **Mispackaged?**: No.

### 3.8 Notice and Takedown
- **Insider definition**: The procedural framework (originating in DMCA but now used broadly) where a rights holder notifies a platform of infringing/illegal content, and the platform removes or disables access. In GitHub's context, this applies to DMCA, government takedowns, and some AUP violations. The key is that notice triggers a duty to act. evidence: [T06-S005] [T06-S004]
- **Outsider misconception**: Think platforms proactively scan all content. Most takedowns are reactive, triggered by external notices.
- **Mispackaged?**: No.

### 3.9 Notice and Counter-Notice
- **Insider definition**: The two-step due process mechanism: (1) notice triggers takedown, (2) counter-notice by the affected user can trigger reinstatement unless the complainant files a lawsuit. In DMCA context, GitHub waits 10-14 business days after counter-notice before re-enabling. This is the user's primary recourse. evidence: [T06-S006]
- **Outsider misconception**: Think takedown is final. The counter-notice mechanism provides a path back.
- **Mispackaged?**: No.

### 3.10 Transparency Reporting
- **Insider definition**: The practice of publicly reporting statistics on content moderation actions, government requests, DMCA notices, and appeal outcomes. GitHub publishes this data at transparencycenter.github.com. The DSA mandates transparency reporting for EU-serving platforms. evidence: [T06-S008] [T06-S033] [T06-S018]
- **Outsider misconception**: Think transparency reports are voluntary PR exercises. Under the DSA, they are legally mandated with specific data requirements.
- **Mispackaged?**: No.

### 3.11 Right to Explanation
- **Insider definition**: Under the EU DSA, platforms must provide affected users with a detailed "statement of reasons" when they restrict content or accounts. This includes the legal/policy basis, facts leading to the decision, and information about available remedies. Goes beyond GitHub's standard suspension notification. evidence: [T06-S018] [T06-S001]
- **Outsider misconception**: Think platforms can silently suspend without explanation. Under DSA, this is illegal for EU users.
- **Mispackaged?**: No.

### 3.12 Terms of Service as Private Law
- **Insider definition**: The concept that platform ToS function as a de facto legal system governing billions of users, with platforms acting as legislators (writing rules), prosecutors (detecting violations), and judges (deciding penalties). In the GitHub context, T&S decisions about account suspension are essentially private adjudication. This is a key legal theory underpinning DSA-style regulation. evidence: [T06-S007] [T06-S018]
- **Outsider misconception**: Think ToS is "just a contract." It functions as a governance system with real-world impact on livelihoods.
- **Mispackaged?**: No.

## Category 4: Open Source Licensing and Compliance

### 4.1 Copyleft License
- **Insider definition**: A license category (GPL, AGPL, LGPL, MPL) that requires derivative works to be distributed under the same or compatible license terms. "Strong copyleft" (GPL, AGPL) requires the entire combined work to be copyleft-licensed. "Weak copyleft" (LGPL, MPL) only requires changes to the licensed component itself. Relevant to GitHub suspension because copyleft-licensed repos remain available to forks even if the original author's account is suspended. evidence: [T06-S025]
- **Outsider misconception**: Think copyleft means "free to do anything." It imposes specific obligations on redistribution.
- **Mispackaged?**: No.

### 4.2 Permissive License
- **Insider definition**: A license category (MIT, Apache 2.0, BSD, ISC) that allows nearly unrestricted use, modification, and redistribution, typically requiring only attribution. The majority of GitHub repos use permissive licenses. Relevant to suspension: permissive-licensed forks survive account suspension because the license grants irrevocable rights. evidence: [T06-S025]
- **Outsider misconception**: Think permissive = public domain. It still has attribution requirements and is still copyrighted.
- **Mispackaged?**: No.

### 4.3 License Compliance
- **Insider definition**: The practice of ensuring that use of open-source software complies with the terms of its license(s). In the GitHub suspension context, compliance obligations survive account suspension: downstream users must still comply with the license terms of forked repos. Tools like FOSSA, Snyk, and WhiteSource automate compliance tracking. evidence: [T06-S025]
- **Outsider misconception**: Think compliance ends when the author's account is suspended. License obligations attach to the code, not the account.
- **Mispackaged?**: No.

### 4.4 CLA (Contributor License Agreement)
- **Insider definition**: A legal contract signed by contributors granting the project maintainer copyright or patent rights over contributions. Used by large projects (Apache Foundation, Google, Microsoft). Relevant to suspension: if a project owner's account is suspended, CLA-signed contributions are still legally licensed to the project. evidence: [T06-S025]
- **Outsider misconception**: Think CLA is the same as the project license. CLA governs the contributor-to-project relationship; the license governs the project-to-user relationship.
- **Mispackaged?**: No.

### 4.5 DCO (Developer Certificate of Origin)
- **Insider definition**: A lightweight alternative to CLA, introduced by the Linux Foundation. Contributors add a `Signed-off-by` line to each commit, certifying they have the right to submit the contribution under the project's license. Used by Linux kernel, Node.js, and many CNCF projects. Less legal protection than CLA but lower friction. evidence: [T06-S025]
- **Outsider misconception**: Think DCO is just a formality. It is a legally meaningful certification under the project's IP framework.
- **Mispackaged?**: No.

### 4.6 FOSS (Free and Open Source Software)
- **Insider definition**: Umbrella term covering both "free software" (FSF tradition, emphasizing user freedom) and "open source" (OSI tradition, emphasizing practical benefits). In the GitHub/sanctions context, FOSS has special status: open-source code is generally considered "informational materials" under OFAC exemptions, meaning passive access to FOSS repos may survive sanctions restrictions. evidence: [T06-S025] [T06-S026]
- **Outsider misconception**: Think "free" means "no cost." Free/libre refers to freedom (to use, study, modify, redistribute), not price.
- **Mispackaged?**: No.

### 4.7 Open Source Definition (OSD)
- **Insider definition**: The 10 criteria defined by the Open Source Initiative (OSI) that a license must satisfy to be considered "open source." Key criteria include free redistribution, source code availability, derived works permission, and no discrimination against persons or fields of endeavor. Criteria 5 (no discrimination against persons) and 6 (no discrimination against fields) are directly relevant to sanctions restrictions on open source. evidence: [T06-S025]
- **Outsider misconception**: Think any code on GitHub is "open source." Without an OSI-approved license, code is all-rights-reserved.
- **Mispackaged?**: No.

### 4.8 Fork Rights
- **Insider definition**: Under open-source licenses, anyone who has received a copy has the right to create a fork (derivative work) and continue development independently. On GitHub, existing forks of a suspended user's repos continue to exist and remain accessible. New forks cannot be created from suspended accounts. This is a critical resilience mechanism against platform-level deplatforming. evidence: [T06-S025] [T06-S007]
- **Outsider misconception**: Think suspension deletes forks. Existing forks survive; only the upstream repo becomes inaccessible.
- **Mispackaged?**: No.

### 4.9 Software Freedom Conservancy Enforcement
- **Insider definition**: A nonprofit organization that holds copyright for member projects and enforces copyleft licenses (primarily GPL). Known for pursuing compliance rather than litigation as a first resort. Relevant because SFC's enforcement model shows that license compliance obligations survive changes in hosting or account status. evidence: [T06-S025]
- **Outsider misconception**: Think GPL enforcement is purely theoretical. SFC actively enforces, and several court cases have established precedent.
- **Mispackaged?**: No.

### 4.10 Copyright Assignment
- **Insider definition**: The transfer of copyright ownership from a contributor to a project or organization (e.g., FSF requires copyright assignment for GNU projects). More legally binding than CLA. Relevant to suspension: if copyright is assigned to an organization whose GitHub account is suspended, the code remains legally owned by the organization regardless of platform status. evidence: [T06-S025]
- **Outsider misconception**: Think copyright assignment means "giving up all rights." Assignors typically retain a license-back to use their own contributions.
- **Mispackaged?**: No.

## Category 5: Account Security Terminology

### 5.1 2FA (Two-Factor Authentication)
- **Insider definition**: A security requirement (mandatory for all GitHub.com accounts since March 2023) that adds a second verification step beyond passwords. GitHub supports TOTP apps, SMS (limited countries), security keys (WebAuthn), and passkeys. Critically relevant to suspension recovery: if you lose 2FA access while suspended, recovery becomes exponentially harder because you cannot access the settings page to reset it. evidence: [T06-S019] [T06-S038]
- **Outsider misconception**: Think 2FA is optional. GitHub enforced mandatory 2FA for all accounts starting 2023.
- **Mispackaged?**: No.

### 5.2 TOTP (Time-based One-Time Password)
- **Insider definition**: An algorithm (RFC 6238) generating 6-digit codes that change every 30 seconds. Used with authenticator apps (Google Authenticator, Microsoft Authenticator, Authy, 1Password). TOTP is the recommended 2FA method for GitHub, especially for users in countries where SMS is not supported (including China +86 and Hong Kong +852). evidence: [T06-S019] [T06-S038]
- **Outsider misconception**: Think TOTP requires internet access. TOTP works offline once the secret is provisioned.
- **Mispackaged?**: No.

### 5.3 Recovery Codes / Backup Codes
- **Insider definition**: A set of one-time-use codes generated when 2FA is enabled. Each code can be used once to bypass 2FA. GitHub generates 16 recovery codes by default. These are the absolute last resort for account access if you lose your 2FA device. For suspended accounts, recovery codes alone cannot bypass the suspension — they only help with 2FA verification during the reinstatement process. evidence: [T06-S021]
- **Outsider misconception**: Think recovery codes can "unlock" a suspended account. They only bypass 2FA, not suspension.
- **Mispackaged?**: No.

### 5.4 SSH Keys (Account-Level Authentication)
- **Insider definition**: RSA/Ed25519 key pairs used for Git operations over SSH. Account-level SSH keys authenticate git push/pull/clone without passwords. When an account is suspended, SSH keys are effectively disabled (the server rejects authentication for suspended accounts). SSH keys can also serve as a recovery factor during 2FA recovery. evidence: [T06-S019] [T06-S021]
- **Outsider misconception**: Think SSH keys bypass suspension. They do not — the suspension is at account level, not protocol level.
- **Mispackaged?**: No.

### 5.5 PAT (Personal Access Token)
- **Insider definition**: OAuth-style tokens used for API and Git HTTPS authentication. Two types: Classic PAT (broad permissions, no expiration optional) and Fine-grained PAT (scoped to specific repos/orgs, mandatory expiration). When an account is suspended, all PATs are invalidated — API calls return 403. On reinstatement, new PATs must be generated. evidence: [T06-S019] [T06-S007]
- **Outsider misconception**: Think saved PATs will work after reinstatement. They are revoked on suspension and must be regenerated.
- **Mispackaged?**: No.

### 5.6 Fine-Grained PAT vs Classic PAT
- **Insider definition**: Fine-grained PATs (introduced 2022) are scoped to specific repositories and organizations, have mandatory expiration, and use granular permissions. Classic PATs have broader access (repo, user, admin scopes) and optional expiration. GitHub is deprecating Classic PATs in favor of Fine-grained. For post-reinstatement security, Fine-grained PATs are recommended to limit blast radius. evidence: [T06-S019]
- **Outsider misconception**: Think Classic PAT is sufficient. Fine-grained PATs are the security best practice post-2022.
- **Mispackaged?**: No.

### 5.7 Passkeys / WebAuthn / FIDO2
- **Insider definition**: Passkeys are WebAuthn credentials that satisfy both password and 2FA requirements, enabling single-step sign-in. Based on FIDO2 standard. Support hardware security keys (YubiKey), platform authenticators (Touch ID, Windows Hello), and software authenticators. The most phishing-resistant authentication method because domain scoping is built into the protocol. evidence: [T06-S019] [T06-S038]
- **Outsider misconception**: Think passkeys are "just fancy passwords." They are cryptographic key pairs that cannot be phished.
- **Mispackaged?**: No.

### 5.8 SMS Verification (GitHub Phone Verification)
- **Insider definition**: GitHub uses SMS for 2FA and for identity verification of flagged accounts. Critically, SMS verification is NOT supported for all countries. China (+86), Hong Kong (+852), and Macau (+853) are NOT in the supported country list. Taiwan (+886) IS supported. This creates a major barrier for Chinese developers whose accounts are flagged — they cannot complete SMS verification to restore access. evidence: [T06-S020]
- **Outsider misconception**: Think any phone number works. GitHub's supported country list excludes major developer populations.
- **Mispackaged?**: No.

### 5.9 GitHub Mobile Authentication
- **Insider definition**: The GitHub Mobile app can serve as a 2FA method: the app shows a two-digit code during web login, and the user confirms on their phone. Works in China (downloadable via App Store/Google Play). This is the recommended alternative to SMS for users in unsupported SMS countries. evidence: [T06-S019] [T06-S020]
- **Outsider misconception**: Think GitHub Mobile is just for browsing repos. It is a fully functional 2FA device.
- **Mispackaged?**: No.

### 5.10 Account Recovery
- **Insider definition**: The process of regaining access to an account when 2FA credentials are lost. Recovery paths (in order of preference): (1) recovery codes, (2) registered SSH keys, (3) verified devices, (4) PATs. If all paths fail, GitHub Support can verify identity through additional means, but this process can take weeks and requires proving account ownership. For suspended accounts, recovery and reinstatement are separate processes that may need to happen sequentially. evidence: [T06-S021]
- **Outsider misconception**: Think GitHub can instantly restore access via email. Multi-factor recovery is intentionally difficult for security reasons.
- **Mispackaged?**: No.

## Category 6: China-Related Legal Terminology

### 6.1 Cybersecurity Law (CSL / 网络安全法)
- **Insider definition**: Enacted June 2017. China's foundational cybersecurity legislation covering network operator obligations, Critical Information Infrastructure (CII) protection, data localization for CII operators, and real-name registration requirements. Relevant to GitHub suspension context: Chinese developers may face domestic legal obligations (data localization, security review) that interact with the decision to use US-hosted platforms like GitHub vs domestic alternatives. evidence: [T06-S028] [T06-S024]
- **Outsider misconception**: Think CSL only affects "Chinese companies." It applies to any entity operating networks in China, including foreign companies with China operations.
- **Mispackaged?**: No.

### 6.2 Data Security Law (DSL / 数据安全法)
- **Insider definition**: Enacted September 2021. Establishes a tiered data classification system (core data, important data, general data) and cross-border data transfer restrictions. Relevant to GitHub context: code repositories containing "important data" (as classified by Chinese authorities) may face restrictions on being hosted on foreign platforms. evidence: [T06-S028]
- **Outsider misconception**: Think DSL is just "China's GDPR." It focuses on data security and national security, not individual privacy (that is PIPL's domain).
- **Mispackaged?**: No.

### 6.3 Personal Information Protection Law (PIPL / 个人信息保护法)
- **Insider definition**: Enacted November 2021. China's comprehensive data privacy law with GDPR-like individual rights (consent, access, deletion, portability) plus extraterritorial scope. Penalties up to RMB 50M or 5% of annual revenue. Relevant to GitHub context: personal information of Chinese users stored in GitHub repos may trigger PIPL compliance obligations. evidence: [T06-S024] [T06-S028]
- **Outsider misconception**: Think PIPL is identical to GDPR. PIPL has stronger data localization requirements and broader government access provisions.
- **Mispackaged?**: No.

### 6.4 Export Control Law (出口管制法)
- **Insider definition**: Enacted December 2020. China's first comprehensive export control framework, controlling dual-use items, military products, and nuclear materials. Establishes China's own Control List (parallel to US Entity List). Relevant to GitHub: Chinese developers working on controlled technology may face restrictions on publishing to foreign platforms. The law is intentionally broad, leaving room for discretionary enforcement. evidence: [T06-S023] [T06-S032]
- **Outsider misconception**: Think China's export controls only apply to physical goods. Like EAR, they cover technology and technical data.
- **Mispackaged?**: No.

### 6.5 Unreliable Entity List (不可靠实体清单)
- **Insider definition**: China's sanctions-style mechanism (regulations published September 2020) targeting foreign entities that endanger China's national sovereignty, security, or development interests. Penalties include import/export bans, investment restrictions, and entry bans. China's mirror of the US Entity List. As of 2026, sparingly used. Relevant to GitHub: could theoretically be applied to GitHub/Microsoft if China-US tech tensions escalate. evidence: [T06-S022] [T06-S035]
- **Outsider misconception**: Think the UEL is heavily used like the SDN list. It has been invoked sparingly, primarily as a deterrent.
- **Mispackaged?**: No.

### 6.6 Alternative Platforms (Gitee / GitLab China / JihuLab / Codeberg / Forgejo / Gitea)
- **Insider definition**: Platforms that developers use as GitHub alternatives, either by choice or because of sanctions restrictions. **Gitee** (gitee.com): China's largest domestic alternative, operated by OSCHINA. **JihuLab** (jihulab.com): GitLab's China JV (terminated 2024; independent successor). **Codeberg** (codeberg.org): German nonprofit running Forgejo, EU-hosted alternative. **Forgejo**: Community fork of Gitea, MIT-licensed, self-hostable. These are critical for business continuity when a GitHub account is suspended. evidence: [T06-S002]
- **Outsider misconception**: Think "just move to Gitee" solves everything. Gitee has its own content censorship requirements under Chinese law, and lacks the global developer network effects of GitHub.
- **Mispackaged?**: No.

### 6.7 +86/+852 SMS Verification Limitation
- **Insider definition**: GitHub's SMS-based verification does not support mainland China (+86), Hong Kong (+852), or Macau (+853) country codes. This creates a critical barrier when a Chinese developer's account is flagged and GitHub requires SMS verification to lift the flag. Workarounds: TOTP app, GitHub Mobile app, or a phone number from a supported country. evidence: [T06-S020]
- **Outsider misconception**: Think getting a virtual US number solves this reliably. GitHub may detect and block virtual/VoIP numbers.
- **Mispackaged?**: No.

### 6.8 VPN Usage and Sanctions Mis-Flagging (翻墙 / 制裁误标)
- **Insider definition**: Chinese developers routinely use VPNs to access GitHub (direct access is throttled but not blocked in China). If a VPN exit node's IP address is in a sanctioned region (e.g., Iran, Crimea), GitHub's automated screening may flag the account as sanctions-associated. This "sanctions mis-flagging" (制裁误标) is a major cause of Chinese developer account suspensions. Using a VPN is a legal gray area in China (个人用 VPN 违法但极少执法) and does NOT violate US sanctions (VPN use itself is not prohibited by OFAC). evidence: [T06-S002] [T06-S020]
- **Outsider misconception**: (1) Think VPN can "unban" a suspended account (it cannot; suspension is account-level, not IP-level). (2) Think VPN use violates US sanctions (it does not; OFAC prohibits disguising location to access sanctioned services, but a Chinese user accessing a non-sanctioned service via VPN is not the same situation).
- **Mispackaged?**: Yes, frequently misrepresented in both directions.

### 6.9 Sanctions Mis-Flagging (制裁误标)
- **Insider definition**: The false-positive scenario where a developer not in a sanctioned country is incorrectly flagged as sanctions-associated, typically due to VPN IP geolocation, travel patterns, or name matching against SDN list entries. GitHub's appeal process specifically addresses this: "In rare instances where accounts are affected unintentionally or in error, GitHub has an appeal process." Historically, about 79% of mis-flagging appeals for Chinese developers are successful. evidence: [T06-S002] [T06-S001]
- **Outsider misconception**: Think mis-flagging is rare. It is a systemic issue affecting thousands of developers in China, Iran, and other non-sanctioned countries with high VPN usage.
- **Mispackaged?**: No.

## Category 7: Outsider Pitfalls (Shibboleth)

These are misconceptions that instantly mark someone as an outsider in the GitHub account reinstatement domain. An insider would never make these mistakes.

### 7.1 Confusing "Suspended" and "Restricted"
- **The mistake**: Using "suspended" and "restricted" interchangeably. In reality, suspension = complete lockout (404 profile, 403 on all operations, cannot log in). Restriction = limited functionality (can still log in, can view repos, some features disabled). The appeal strategy, urgency, and prognosis differ dramatically. evidence: [T06-S001] [T06-S003]
- **Why it matters**: Filing for "reinstatement" when you are merely "restricted" wastes T&S review bandwidth and delays your case. Filing for "appeal of restriction" when you are fully suspended uses the wrong form.

### 7.2 Confusing DMCA Takedown with Account Suspension
- **The mistake**: Thinking a DMCA takedown on a repo means the account is suspended. They are different enforcement tracks. DMCA targets specific infringing content (repo/file level). Account suspension targets the user (account level). A DMCA takedown does not suspend the account; an account suspension does not target specific copyright claims. evidence: [T06-S005] [T06-S003]
- **Why it matters**: The appeal procedures are completely different. DMCA uses counter-notice (sworn legal document). Account suspension uses the reinstatement form (factual explanation).

### 7.3 Thinking China is a US-Sanctioned Country
- **The mistake**: Believing that China (PRC) is comprehensively sanctioned like Iran, Cuba, or DPRK. It is NOT. Specific Chinese entities/persons may be on the SDN or Entity List, but China as a country is not subject to comprehensive sanctions. Chinese developers are flagged due to VPN IP coincidence with sanctioned regions or individual SDN matches, not because China is sanctioned. evidence: [T06-S009] [T06-S002]
- **Why it matters**: The appeal strategy for a mis-flagged Chinese developer is fundamentally different from that of a developer genuinely in a sanctioned country. The Chinese developer can demonstrate they are not in a sanctioned region; the Iranian developer needs to invoke GL D-2.

### 7.4 Thinking Ban Evasion is a Viable Strategy
- **The mistake**: Creating a new account after suspension, thinking it is a fresh start. GitHub explicitly prohibits ban evasion under AUP, detects it through IP/device/payment/behavioral fingerprinting, and responds by permanently suspending both accounts with no appeal. evidence: [T06-S003]
- **Why it matters**: Ban evasion is the single most common way a recoverable suspension becomes permanent. An insider always files an appeal first.

### 7.5 Thinking Appeals Have No Time Window
- **The mistake**: Waiting months or years to appeal, assuming "I can always appeal later." GitHub's policy explicitly states a 6-month window: "You may appeal a moderation decision for up to six months following the decision." After 6 months, GitHub "may refuse" to consider the appeal. evidence: [T06-S001]
- **Why it matters**: Delayed appeals have lower success rates and may be rejected outright. The ideal window is within 30 days.

### 7.6 Confusing OFAC Sanctions and BIS Export Controls
- **The mistake**: Treating OFAC sanctions and BIS/EAR export controls as the same thing. OFAC (Treasury) prohibits transactions with sanctioned countries/persons. BIS (Commerce) controls export of dual-use items. They have different legal frameworks, different penalty structures, and different exemptions. GitHub's trade controls page addresses both but they trigger different account actions. evidence: [T06-S009] [T06-S014] [T06-S002]
- **Why it matters**: The appeal language and legal basis differ. An OFAC issue invokes General Licenses and informational materials exemptions. A BIS issue invokes ECCN classification and de minimis thresholds.

### 7.7 Thinking VPN Can "Unban" an Account
- **The mistake**: Believing that using a VPN to change your IP address will lift a suspension. GitHub suspension is account-level, not IP-level. Changing your IP does nothing to a suspended account. Worse, using a VPN with an exit node in a sanctioned region can trigger additional flags. evidence: [T06-S002] [T06-S003]
- **Why it matters**: VPN use during the appeal process can actually harm your case if GitHub detects you're accessing from a sanctioned-region IP.

### 7.8 Thinking GitHub Enterprise is Immune to Sanctions
- **The mistake**: Believing that paying for GitHub Enterprise exempts an organization from sanctions compliance. GitHub Enterprise (both Cloud and Server) is subject to the same OFAC and EAR restrictions. Enterprise Server is classified under ECCN 5D992.c. Enterprise accounts in sanctioned regions are downgraded to "archived read-only repositories." evidence: [T06-S002]
- **Why it matters**: Organizations that assume Enterprise is a sanctions workaround face the same restrictions, plus potential OFAC liability for the organization itself.

### 7.9 Thinking GitHub Support = GitHub Trust & Safety
- **The mistake**: Contacting general GitHub Support (billing, technical issues) expecting them to handle suspension/reinstatement. General Support cannot lift suspensions or process appeals. Only T&S has that authority. The correct channel is the Appeal and Reinstatement form, not a general support ticket. evidence: [T06-S001]
- **Why it matters**: Filing through the wrong channel delays resolution and may result in unhelpful generic responses.

### 7.10 Thinking "Open Source is Exempt from Sanctions"
- **The mistake**: Believing that because your repos are open source, they cannot be affected by sanctions. While OFAC's informational materials exemption generally covers passive access to open-source code, it does NOT cover: active service provision (hosting, CI/CD, paid features), collaborative services (pull request review, issue tracking), or any transaction with an SDN-listed individual. evidence: [T06-S016] [T06-S026]
- **Why it matters**: Developers who assume open-source status protects them miss the distinction between code (potentially exempt) and services (not exempt).

## Regulatory Framework Comparison Table (China vs US vs EU)

### Sanctions and Export Control Frameworks

| Dimension | US | China | EU |
|-----------|----|----|-----|
| Sanctions authority | OFAC (Treasury) | MOFCOM (Unreliable Entity List) | EU Council (Restrictive Measures) |
| Export control authority | BIS (Commerce) / DDTC (State) | MOFCOM (Export Control Law) | EU DG Trade (Dual-Use Regulation) |
| Primary sanctions law | IEEPA; EOs per program | Unreliable Entity List Provisions (2020) | EU Sanctions Regulations per program |
| Primary export control law | EAR (15 CFR 730-774); ITAR (22 CFR 120-130) | Export Control Law (2020); Dual-Use Items Catalogue | EU Dual-Use Regulation (2021/821) |
| Sanctions lists | SDN; SSI; Entity List; DPL | Unreliable Entity List; Export Control List | EU Consolidated List |
| Strict liability? | Yes (OFAC) | Yes (ECL Art. 34) | Yes (EU sanctions) |
| Informational materials exemption | Yes (31 CFR 560.210) | No direct equivalent | Partial (humanitarian/media exemptions) |
| Internet communications license | GL D-2 (Iran specific) | No equivalent | Derogation by EU Council decision |
| Key references | evidence: [T06-S009] [T06-S014] [T06-S037] | evidence: [T06-S022] [T06-S023] [T06-S032] | evidence: [T06-S018] |

### Data Protection and Cybersecurity Frameworks

| Dimension | US | China | EU |
|-----------|----|----|-----|
| Comprehensive privacy law | No federal law (sector-specific: HIPAA; COPPA; state: CCPA) | PIPL (2021) | GDPR (2018) |
| Cybersecurity framework | NIST CSF (voluntary); sector mandates | CSL (2017) - mandatory for network operators | NIS2 Directive (2022) |
| Data security/classification | Sector-specific (FISMA for federal; no universal) | DSL (2021) - core/important/general data tiers | GDPR data categories; NIS2 essential/important entities |
| Cross-border data transfer | No general restriction (but CFIUS review) | Security assessment / SCC / certification required | GDPR adequacy / SCC / BCR |
| Data localization | No general requirement | CII operators must localize | No general requirement (but national security exceptions) |
| Key references | evidence: [T06-S017] | evidence: [T06-S024] [T06-S028] | evidence: [T06-S018] |

### Platform Accountability Frameworks

| Dimension | US | China | EU |
|-----------|----|----|-----|
| Platform liability shield | CDA Section 230 (broad immunity) | No general immunity; platforms liable per CSL | DSA (conditional immunity with due diligence) |
| Content moderation mandate | None (Good Samaritan voluntary) | Real-name registration; illegal content removal mandatory | DSA tiered obligations by platform size |
| Transparency reporting | Voluntary | Required per CAC regulations | DSA mandatory (Art. 15; 24; 42) |
| User appeal rights | None (platform-set policy) | Administrative reconsideration | DSA Art. 20 (internal complaint; out-of-court resolution) |
| Right to explanation for moderation | No | No explicit right | DSA Art. 17 (statement of reasons) |
| Key references | evidence: [T06-S017] [T06-S027] | evidence: [T06-S028] | evidence: [T06-S018] |

## Phase 2 Distillation Prompts

### Industry Expression DNA Candidates

The following linguistic patterns distinguish insiders from outsiders in this domain:

1. **Suspension vs Restriction vs Flagging precision**: Insiders never conflate these three states. Each has specific consequences, appeal paths, and recovery timelines. Using the wrong term in a support ticket or appeal signals ignorance and may delay resolution.

2. **OFAC vs BIS bifurcation**: Insiders always specify which regulatory regime is at play. "Sanctions" without qualification is an outsider tell. "OFAC sanctions" (country/person targeting) vs "BIS export controls" (item classification) are completely different legal frameworks.

3. **"Appeal" vs "Reinstatement" distinction**: Insiders know these are two separate legal postures — appeal disputes the violation occurred; reinstatement acknowledges it and promises compliance. Choosing the wrong one weakens your case.

4. **"Informational materials" as a legal term of art**: Insiders cite 31 CFR 560.210 and know the exemption covers passive access to code but NOT active services. This precision is the difference between a valid legal argument and wishful thinking.

5. **"GL D-2" as shorthand**: Insiders reference General License D-2 by its designation, not "the law that lets Iranians use GitHub." This signals fluency with the OFAC licensing framework.

6. **"403" as a diagnostic signal**: Insiders read a 403 Forbidden on git push as a potential suspension indicator, not a generic permission error. The first troubleshooting step is checking account status, not debugging credentials.

7. **"Ban evasion" as a terminal escalation**: Insiders treat ban evasion as the nuclear option that makes everything worse, never as a workaround.

### Top 5 Outsider Misconceptions (Ranked by Frequency and Severity)

1. **"My account is banned because I'm in China"** (Severity: HIGH) — China is not a sanctioned country. The ban is almost certainly due to VPN IP coincidence with a sanctioned region. The appeal is straightforward: prove you are in China, not in Iran/Crimea/Cuba/DPRK/Syria. Success rate approximately 79%.

2. **"I'll just create a new account"** (Severity: CRITICAL) — Ban evasion is the fastest way to convert a recoverable suspension into a permanent one. GitHub detects and permanently bans both accounts. No appeal.

3. **"DMCA took down my repo, so my account is suspended"** (Severity: MEDIUM) — These are different enforcement tracks. DMCA targets content. Suspension targets accounts. The procedures, legal frameworks, and appeal mechanisms are completely different.

4. **"I can appeal whenever I want"** (Severity: HIGH) — The 6-month appeal window is real and enforced. After 6 months, GitHub "may refuse" to consider the appeal. File early.

5. **"Enterprise/paid accounts are exempt from sanctions"** (Severity: HIGH) — GitHub Enterprise is subject to the same OFAC and EAR restrictions as free accounts. Paying does not create a sanctions exemption. Enterprise Server is ECCN 5D992.c.

### Cross-Track Integration Notes

- **Track 01 (Industry Overview)**: Use glossary terms precisely in overview narratives. The suspension/restriction/flagging taxonomy is foundational.
- **Track 02 (Tools)**: Tool descriptions should reference correct regulatory terms (OFAC, BIS, ECCN) when describing compliance screening features.
- **Track 03 (Workflows)**: Appeal and reinstatement workflows must use the correct term at each step. Workflow step names should match GitHub's official terminology.
- **Track 04 (Figures)**: When profiling practitioners, use their domain-specific vocabulary — sanctions lawyers use OFAC terminology; GitHub community advocates use platform terminology.
- **Track 05 (Anti-Patterns)**: The outsider pitfalls in Category 7 are primary inputs for anti-pattern identification.
