In recent years, one of the significant changes in the way social control policies are enforced in Iran has been the expansion of business owners’ responsibility for the conduct of individuals who are neither their employees nor necessarily under their legal authority or supervision. The owner of a restaurant, café, gym, or tourism center, or the organizer of a tour, has gradually found themselves facing a situation in which they may be reprimanded, summoned, required to sign a pledge, fined, or even have their business sealed because of the conduct of a customer or traveler. For example, if a tourist on a tour fails to observe the mandatory hijab, or a café customer engages in conduct that the government considers contrary to social regulations, who bears responsibility? Can the mere contractual relationship between a customer and a service provider serve as the basis for the criminal liability of the business owner? Recent reports concerning intensified measures against businesses and tourism establishments show that this issue is no longer a hypothetical legal question and has, in practice, become a method of enforcing social control. Even in cases where the contested conduct was not directly committed by the business owner, pressure on the business has been used as a means of compelling the owner or manager to control customers’ behavior. In such a situation, the central issue is no longer merely hijab or the type of conduct displayed by a customer, but whether the state can turn a citizen engaged in providing an economic service into someone responsible for controlling the behavior of others and, if that person is unable or unwilling to exercise such control, subject them to criminal or administrative sanctions. If applied without precisely defining the limits of responsibility and without establishing fault or involvement on the part of the person being punished, this approach calls into question one of the fundamental principles of criminal law: no one should be punished merely because of another person’s conduct.

In criminal law, the starting point for answering this question must be the principle of personal criminal responsibility. Criminal liability generally attaches to a person when the criminal conduct, or at least an omission carrying criminal character, can be attributed to that person and there is a relationship between their conduct and the alleged result. Ownership of a business establishment, management of a tourism operation, or provision of services to a customer does not, in itself, create such a relationship. If a passenger on a tour engages in conduct that the law considers a crime, the principle is that responsibility for that conduct lies with the person who committed it, not the tour organizer. The same logic applies to a restaurant, café, gym, or any other business. One cannot conclude merely from the fact that conduct occurred on business premises or in the course of an economic service that the owner of that business also played a criminal role in committing it.

For responsibility to be attributed to another person, there must be a clear legal basis and specific elements of criminal liability, including that the law has imposed a particular duty on that person and that the breach of that duty has been established under the conditions required for criminal responsibility. This distinction is of fundamental importance in criminal law, because if mere ownership or management is sufficient to create liability, the boundary between “committing a crime” and “being in a position adjacent to a crime” disappears. In such a situation, the business owner is effectively punished not for their own conduct, but for their inability to control the behavior of others. The result of such an approach is a transformation in the nature of criminal responsibility. A citizen who played no role in creating the contested conduct is placed in the position of an accused person merely because they manage the place where that conduct occurred. This is precisely the point at which social control policy in Iran moves beyond enforcing the law against the specific conduct of an individual and reaches the imposition of responsibility on third parties. Such an interpretation is not only incompatible with the principle of personal criminal responsibility, but also weakens the principle of legality of crimes and punishments and the requirement that the limits of criminal responsibility be foreseeable. The state cannot first place a citizen in a position where they are expected to control the behavior of dozens or hundreds of customers and travelers and then, when one of them commits a violation, use that person’s inability to exercise complete control over others as the basis for punishment. If such logic is accepted, every business owner will effectively become an enforcement arm of the government’s social policies, and responsibility for monitoring citizens will be transferred from public institutions to private business owners.

But this does not mean that a business owner can never bear responsibility under any circumstances. The issue lies precisely in determining this boundary. If a business owner personally commits criminal conduct, knowingly and intentionally encourages or assists a customer in committing a crime, or if the law specifically and under clearly defined conditions imposes a duty on them and the breach of that duty itself carries criminal consequences, their responsibility can be discussed. But there is a fundamental difference between such a situation and the mere occurrence of prohibited conduct by a customer. A tourism operator cannot be expected to control every single traveler throughout the entire journey and then be held accountable for every possible violation committed by them. Likewise, the owner of a café or restaurant cannot be regarded as an accomplice to a crime merely because a customer engaged in certain conduct on the business premises. Accepting such logic effectively transforms the concept of a “legal duty” into a “duty to control others,” while criminal law cannot create unlimited and ambiguous responsibility. Even if the state seeks to impose supervisory duties on business owners, those duties must be precise, clear, foreseeable, and proportionate to the actual possibility of carrying them out. A business owner cannot be expected, in order to retain their operating license, to assume the role of a police officer or judicial officer toward customers. Such a situation not only distances criminal liability from personal conduct, but also changes the relationship between citizens and business owners. The business owner is no longer merely a provider of goods or services, but is compelled to become a monitor of customers’ clothing, behavior, and social relations. This is precisely the point at which social control policies can penetrate citizens’ private and economic spheres. Instead of keeping responsibility for law enforcement with public institutions and its own legally authorized officers, the state transfers part of this duty to business owners and, in return, establishes sanctions against them. In such a structure, sealing or threatening to seal a business establishment is not merely a punishment imposed on a business owner, but a means of compelling that person to exercise social surveillance over others.

In practice, what has been seen in Iran in recent months is not merely the enforcement of existing regulations, but an effort to expand the range of conduct in which the government seeks to intervene and, in some cases, punish. Published reports concerning actions against businesses, online pages, and public spaces show that in numerous cases, the measures have concerned mandatory hijab, “norm-breaking,” “contrary to public decency,” and similar expressions. This trend reveals a more important issue: the authorities do not merely seek to control citizens’ behavior in cases where the law has clearly criminalized it, but in some cases attempt first to bring citizens’ legitimate personal and social conduct within the realm of violation or crime through labels such as “norm-breaking” and “contrary to proprieties,” and then transfer responsibility for controlling that conduct to other people as well. Within this structure, the café owner, restaurant manager, or tour organizer is gradually transformed from a service provider into a monitor of customers’ social behavior. This is where social control policy takes on a more dangerous form: the government does not merely restrict citizens’ freedoms, but places citizens in a position where, in order to preserve their businesses and livelihoods, they are compelled to control the behavior of other citizens. In this way, responsibility for implementing a public policy is transferred from government institutions to private individuals and businesses, effectively setting people against one another. To avoid being punished themselves, business owners must warn customers, prevent them from entering, or control their conduct; otherwise, they may themselves face summonses, pledges, closure, or other sanctions. Such an approach is not merely an issue of criminal law; it also transforms social relations among citizens and turns individuals into instruments for enforcing control policies against one another. As a result, instead of being directly accountable within the framework of the law for its own interference with citizens’ freedoms, the state delegates part of this intervention to business owners and places them before an unfair choice: either tolerate the customer’s freedom and conduct and pay the price for it, or, in order to preserve their business, resort to controlling and restricting others.

Ultimately, the issue should not be reduced merely to whether the owner of a café, restaurant, or tourism tour should “monitor” customers’ conduct. The more fundamental question is whether, within a legal system, personal criminal responsibility can be transformed into vague vicarious responsibility and whether a citizen can be subjected to punishment or restrictions for conduct they did not themselves commit. The answer, at least from the perspective of the fundamental principles of criminal law, must be no. If the state believes that certain conduct is a crime, it must prosecute the person who committed that conduct on the basis of a clear and foreseeable law and with full observance of all procedural safeguards. It cannot gradually expand ambiguous labels such as “norm-breaking” and “contrary to proprieties” and then impose responsibility on business owners, thereby both expanding the range of punishable conduct and transferring responsibility for enforcing this policy to citizens. Such an approach ultimately blurs two boundaries simultaneously: the boundary between criminal conduct and citizens’ lawful conduct, and the boundary between the state’s responsibility to enforce the law and the responsibility of private individuals for the conduct of others. Business owners should not be forced, in order to preserve their workplace and livelihood, to become agents of social control over their customers, nor should customers have to know that their personal conduct may carry criminal and economic consequences not only for themselves, but also for the owner of the premises, the tour organizer, or the service provider. If every citizen is to be held accountable for the conduct of another citizen, the principle of personal criminal responsibility will effectively be emptied of meaning, and society will be transformed into a network of mutual surveillance.