Duo to block authentication in countries or regions subject to OFAC sanctions

Dear UIC community,

The University of Illinois Chicago, like many other universities and businesses around the world, uses Duo two-factor authentication to provide enhanced security for our applications and data.

Recently, UIC learned that, to comply with U.S. regulations, Duo will begin blocking authentications from users whose IP address originates in a country or region subject to economic and trade sanctions enforced by the U.S. Office of Foreign Assets Control. Other U.S.-based companies and organizations with whom we partner, including Microsoft and Zoom, also have placed similar restrictions.

Starting May 5, 2022, any attempts to authenticate to Duo-protected applications from within the OFAC-regulated countries or regions listed below will be blocked from completing their login and will receive an error message:

• Cuba.
• Iran.
• North Korea.
• Sudan.
• Syria.
• Crimea region.
• Donetsk region.
• Luhansk region.
• Sevastopol region.

This restriction is based on location, not identity, and applies to all methods of Duo authentication, including the Duo mobile app, SMS text messages, phone calls and physical tokens. This means that University of Illinois Chicago affiliates based in, or traveling to, these countries or regions will not be able to access Duo-protected applications, which include UIC Exchange email, Box, Qualtrics, the UIC VPN, U of I Administrative Systems (e.g. Banner), and others. As noted above, individuals are also unable to access Zoom, and other providers may follow suit at any time.

As you can imagine, these systems are used throughout higher education and beyond, and everyone is similarly facing the impact of these restrictions. We know that there are UIC students who return home to these countries and that UIC research is taking place in some of these countries as well.  Anyone planning to travel internationally for any reason should review “I will be traveling internationally. Will I have access to university resources while abroad?” to learn more about what university technology resources you may or may not be able to access while traveling to these counties and how to best work with the restrictions in place. As noted in the article, these restrictions are based on geopolitics and federal government regulations and can change without notice.

For those traveling to the above countries for UIC business, research or personal reasons, it is important to contact the OVCR Export Controls Compliance Office prior to travel at uicexport@uic.edu. Many of these countries are subject to sanctions and approvals/licenses may be required. Many of these countries are subject to sanctions and approvals/licenses may be required. Students should contact the Office of Global Engagement at oge@uic.edu.

Visit the Information Technology website for more information.

Regards,

Matt Riley
Associate Vice Chancellor for Innovation and CIO