In practice, of course they could unless Github specifically tracks that kind of thing. I'm no expert on sanctions law, I mostly know what I do from having rea

In practice, of course they could unless Github specifically tracks that kind of thing. I'm no expert on sanctions law, I mostly know what I do from having read all the compliance stuff at work. There's a lot of law that's effectivey enforced by business. All the alcohol prohibition for minors, for instance, is enforced by your local bar checking ID. And many laws aren't intended to have perfect enforcement. Take taxes. Banks won't, for instance, send a 1099 to the IRS if you have a small balance, even if you earned some interest. And there's no one tracking your cash income, but if you had a large amount and got audited you could be in trouble. Likewise, sanctions aren't meant to be perfect, the intent is to hamper the target nation's economy by restricting most trade. So the law always has to be black and white as to whether a thing is illegal. It then deals with the "grey" part through how it enforces it. Here I'd observe it's not monitored by a deputized business, and the executive won't prioritize it.