Error: Forbidden

Guest Author | Internet Governance Researcher, Governance Lab

A strange thing happened when I recently tried to open a LinkedIn link from Iran. LinkedIn itself was accessible. But a shortened LinkedIn URL was not.

From an Iranian IP address, “lnkd.in” completed a TLS 1.3 handshake, presented a valid certificate, and reached LinkedIn’s infrastructure. It then returned an HTTP/2 403 Forbidden response (banner image).

The same URL, accessed through a non-Iranian IP address, returned an HTTP/2 301 redirect to the intended LinkedIn page, which subsequently loaded with an HTTP/2 200 response (Figure 1).

The difference was not DNS resolution, TCP connectivity, or TLS negotiation. The request reached LinkedIn infrastructure successfully. What changed was the treatment of the request after it arrived: the response was apparently dependent on the source IP and, potentially, its geographic classification.

I cannot establish from this observation alone that sanctions caused LinkedIn to make this decision. But the technical anomaly raises a broader question: what happens when sanctions compliance is translated into the infrastructure through which people access the Internet?

Sanctions are usually discussed in terms of banks, oil exports, trade, and financial transactions. Yet their effects can reach much deeper into the digital stack: cloud infrastructure, content delivery networks, authentication systems, software distribution, IP-based access controls, and, critically, the public key infrastructure that allows browsers to establish trust in websites.

Consider certificate revocation. A server may remain operational. Its domain may continue to resolve through DNS. The network path may remain available. But if a trusted certificate is revoked, the browser can reject the connection because the cryptographic chain of trust can no longer be established.

The website exists, but for the user, it is effectively gone. This distinction matters because not every certificate failure is sanctions-related. Certificate authorities revoke certificates for a range of technical, security, and compliance reasons. Recent industry-wide revocation events, for example, have resulted from failures to meet CA/Browser Forum validation requirements rather than geopolitical restrictions.

At the same time, sanctions create a distinctive compliance environment in which private infrastructure providers must assess not only what is prohibited, but also what may expose them to legal or commercial risk. This distinction is particularly important in Iran. US sanctions regulations explicitly authorize a broad range of Internet communications services, including certain cloud-based services and software supporting communications, and specifically include software related to SSL certificate provisioning and verification under defined conditions.

The existence of such authorizations does not, however, mean that every provider will necessarily feel comfortable serving every Iranian user, institution, or network. Compliance decisions are made within corporate risk frameworks, and those frameworks can produce restrictions that extend beyond the narrowest interpretation of what is legally required.

This is where “over-compliance” becomes technically significant. A provider does not necessarily need to block an entire country. It can classify an IP address, restrict a particular autonomous system, refuse an account, deny a certificate request, alter routing behavior or return a different HTTP response. Each decision may appear narrow and technically defensible. Collectively, however, such decisions can change how an entire population experiences the global Internet.

The user does not see the sanctions analysis behind the decision. They see a 403. They do not see the compliance review behind a certificate refusal. They see a browser warning. This is where sanctions policy begins to intersect with Internet architecture. Iran already experiences another form of Internet restriction through domestic filtering and network controls. Research by the Internet Society has documented how domestic restrictions and international sanctions have jointly contributed to degraded connectivity, higher costs, and reduced access to Internet services and technologies in Iran. It has highlighted the difficulty of distinguishing between domestic censorship, international sanctions, geoblocking, and ordinary technical failure.

These mechanisms are politically and legally different. Their technical effects, however, can converge at the point that matters most to users: whether a service works.

The Internet Society has previously warned that sanctions can unintentionally deny ordinary people access to Internet services and that measures affecting core Internet infrastructure can contribute to geopolitical fragmentation of the global network.

The response in Iran is increasingly framed around technological sovereignty: if foreign providers can withdraw certificates, cloud services, or other infrastructure, perhaps equivalent systems should be developed domestically or through alternative international providers. But sovereignty has a paradox of its own. A domestic or non-Western certificate authority could increase control over infrastructure within Iran. Yet unless its root certificates are trusted by major browsers and operating systems globally, it cannot simply reproduce the trust architecture of the public Internet. Greater infrastructural autonomy can therefore coexist with deeper technical separation.

This is why the policy conversation needs to move beyond whether sanctions are effective or justified. We also need to ask how sanctions and compliance decisions behave when they enter the technical layers of the Internet. At what point does a legal restriction on a sanctioned entity become a technical restriction affecting an entire population? And when that boundary is crossed, who is accountable for the resulting loss of connectivity?

Imad Payande is a Digital Governance Researcher at Data for Governance Lab.

The views expressed by the authors of this blog post are their own and do not necessarily reflect the views of the Internet Society.