In February 2018, shortly after the implementation of a temporary ban on Telegram, Small Media published a report profiling some of the messaging apps looking to take its place as Iran’s most widely used messaging app. Over the last year, each of these pretenders has received substantial support from the Iranian state apparatus, including repeated publicity, supportive policy development, and material resources.

So since last year, have any of these homegrown messaging apps been able to topple Telegram from its post? And what are Iranian officials’ aspirations for the future of these apps?

Over the last ten months the government has steadily intensified its support for domestic messaging apps. Yet in the face of slow user growth, an increasing number of officials and commentators have come to deem the initiative a failure.

This perception of the Iranian government’s failure stems from the misunderstanding that Iran is seeking to completely replace foreign messaging apps with domestic ones. While this may be a long-term ambition, Iran’s immediate objective is to popularise the use of domestic messaging apps nationwide. This was not an ad-hoc response to the filtering of Telegram, but a policy that was carefully designed and agreed on months before the December 2017 protests which lead to an eventual ban of Telegram.

In this issue of Filterwatch, we’ll outline the key developments over the last ten months, and argue that the ICT Ministry’s policy of promoting domestic messaging apps continues to pose a significant long-term threat to digital rights in Iran.

We argue that to call domestic messaging apps a failure is to ignore some troubling developments over the course of the last ten months, including the extent of user data collected by domestic messaging apps, or the ongoing plans to promote and integrate domestic messaging apps into Iran’s ongoing expansion of eGovernment and digital infrastructure development.

The History of Iran’s Domestic Messenger Services

• May 2017 — SCC Announces Domestic Messenger Ambitions

Several months before the anti-government protests of December 2017, the Supreme Council of Cyberspace (SCC) published a document titled “Policies and Actions Regarding the Organisation of Social Media Messaging Applications”. The publication of this document was a significant indicator for the future development of Iran’s domestic messaging apps. For the first time, an official document ratified by Iran’s most prominent ICT policy-making body outlined an explicit commitment to promote domestic messaging apps, and to support them to supplant international apps such as Telegram.

While the document outlined specific tasks for governmental bodies such as the IRIB and the judiciary, it made it clear that the ICT Ministry would play the leading role in supporting the development of domestic messaging apps.

• December 2017 — Anti-Government Protests Accelerate Anti-Telegram Policies

In the wake of the December 2017 and January 2018 protests — which led to the judiciary’s filtering of Telegram — technical and financial support for domestic messaging apps was rapidly intensified among a variety of state institutions.

• April 2018 — Domestic Messaging Apps Receive Government Loans

On 30 April 2018, ICT Minister Deputy Rasool Soraya confirmed that in line with the policies set by the SCC, three Iranian domestic messaging apps were each granted 50 billion IRR in ICT Ministry-granted loans.

• May 2018 — Privacy Concerns and Controversies Lead To Slow Growth

Despite the influx of resources, growth remained sluggish. Around this time, domestic messaging apps started publicly admitting that they faced two sets of challenges in attracting users.

Firstly, they argued that Iran lacked the ICT infrastructure to support the volume of usage of a platform like Telegram. On 14 May, Seyyed Meysam Salehi, the CEO of the messaging app Soroush said that the biggest challenge facing domestic messaging apps was the allocation of internet bandwidth. At the same time, he listed a number of infrastructure-related issues including the allocation of content delivery networks (CDNs), limited cloud storage, and a lack of other critical digital infrastructure.

Secondly, apps were quick to admit that the general public continue to lack trust in domestic messaging apps, and that there remained concerns over privacy and censorship.

Public concern about apps’ respect for user’s data peaked in May 2018, when a number of Iranian social media users objected to Soroush profiles being set up for them without their consent. Users claimed that family and friends were able to find their profile listed with their name and phone number as soon as they downloaded the app on their devices. Soroush denied that they had automatically created profiles for Iranian users. Despite the public outrage there has so far been no official investigation into this controversy.

• July 2018 — Government Addresses Privacy Concerns

In light of growing public concerns over privacy and data protections for users of domestic messaging apps, ICT Minister Mohammad-Javad Azari Jahromi acknowledged that more work needed to be done to make users feel secure. Even Supreme Leader Ali Khamenei felt the need to address these concerns in April 2018 , demanding in a speech that the privacy of internet users be respected. In an attempt to support the project of domestic messaging apps, Jahromi’s ICT Ministry brought forward the ‘User Data Protection Bill’ on 28 July 2018.

According to Jahromi, the bill was to be discussed in Iranian cabinet the following day, and was scheduled to be sent to the Parliament for approval. However, to this day the bill has still not been sent to Parliament — potentially failing to gain the support of Rouhani’s cabinet.

The fact that this flagship data protection bill has gone MIA suggests that either Jahromi’s ICT Ministry was being disingenuous in pledging its commitment to online privacy, or that it is unable to secure a consensus in government.

• November 2018 — With Domestic App User Growth Still Low, Some Conservatives Return to Telegram

The wholesale migration of the official channels of conservative-aligned news agencies, state bodies, and the Supreme Leader from Telegram to domestic messaging app in early 2018 was an important symbolic marker of the state’s desire to squeeze Telegram out of the market altogether.

However, the continued lack of users on domestic messaging apps, and these pages’ comparatively limited reach resulted in a number of conservative news agencies quietly returning to Telegram in November 2018. To many, this reversal neatly symbolised the failure of the government’s perceived aspiration to make domestic messaging apps leaders in Iran’s online media ecology.

#fail? — Accusations of ‘Failure’ and the Blame Game

Despite the filtering of Telegram in early 2018, domestic messaging apps have so far failed to gain an active user base anywhere near the size that Telegram enjoyed in Iran. On 4 January Deputy ICT Minister Hamid Fathi claimed that there are currently 15 million users registered on domestic messaging apps. However, based on the publicly available figures, it is difficult to substantiate this claim. For instance, Soroush currently claims to have 10 million registered users, and 5 million active users. However, according to Cafe Bazaar it has only around 2 million active installs at present.

For many commentators, the limited number of active users represents an unambiguous failure of the government’s policies promoting domestic messaging apps.

Naturally, many of those who were hoping to see rapid growth in the sector were leading voices in criticising the government for its perceived failure. Over the last ten months, domestic messaging app developers and entrepreneurs have repeatedly complained about a lack of support being offered by state-affiliated organizations. According to media reports, in a November 2018 meeting between directors of domestic messaging app companies and the ICT Ministry, several company directors complained about a lack of adequate technological support.

Also in November 2018, an IRIB news programme known for its close links with conservatives repeatedly criticized the ICT Ministry for not being sufficiently committed to supporting domestic messaging apps.

Responding to the programme, a senior ICT Ministry official took to social media to deny IRIB’s claims. Deputy ICT Minister Hamid Fatahi published an infographic explaining the ICT Ministry’s analysis of the progress made by government ministries and state organisations in providing support to domestic messaging apps, as outlined in a document entitled “Supporting Domestic Messaging Apps” which was passed by the SCC on 1 August 2016.

Although the “Supporting Domestic Messaging Apps” document was discussed by the SCC months before the May 2017 “Policies and Actions Regarding the Organisation of Social Media Messaging Applications” document, this was the first time that so many details of the responsibilities outlined in that document were made public.

What the August 2016 document makes clear is that the long-term plan for promoting domestic messaging apps in Iran was not a knee-jerk reaction to the December 2017 — January 2018 protests, but has rather been a core objective of the Rouhani administration’s long-term strategy for ICT development since at least August 2016.

Therefore the project’s success or failure must be considered in light of more than just the number of users gained by the apps over the last 10 months, as not all the infrastructural support envisioned for the apps has yet been delivered.

Also, what is becoming evident after reading the commitments outlined in Fatahi’s tweet is that Iran has a long-term aspiration to integrate a number of services into domestic messaging apps in order to popularise them further — services such as financial transactions, that could not otherwise be accessed via international apps under the existing sanctions regime.

Until the action plan outlined by Fatahi has been rolled out in full, we should remain vigilant about the uptake of domestic messaging apps and their long-term implications for user privacy in Iran. After all, Iran’s National Information Network (SHOMA) remained an underfunded and poorly understood government project for many years after its announcement in 2005. Now, the infrastructure project is recognised as a key pillar of Iran’s information control strategy.

Puny Protections — No Sign of Data Protection Reforms on the Horizon

Just because these government-backed messaging apps are off to a slow start is not to say that they will not take on more significance as time rolls on, as additional infrastructure is deployed to support them. As such, we’d argue that it’s important to apply serious scrutiny to the troubling data practices of these companies over the past ten months.

In this sense, the last few months have proven the need for strong legal protections to be offered to Iranian users. Whereas many of the most urgent digital rights concerns in Iran are rooted in punitive bills such as the 2010 Computer Crimes Law, we would argue that the lack of meaningful user data protections could offer similar risks to users in the long term.

Even the draft ‘User Data Protection Bill’ published by Jahromi failed to address the intrusive and aggressive tendencies of the 2010 Computer Crimes Law. Meaningful data protection frameworks cannot be introduced without addressing the challenges posed by the 2010 Computer Crimes Law head-on.

In the absence of a legal framework, there also appear to be no political consequences for unethical practices such as forced profile creation on the part of apps like Soroush. The Soroush user data scandal was dismissed without any meaningful inquiries — whether rooted in malice, disrespect for users’ privacy, or sheer incompetence, this astonishing lack of accountability is a deeply worrying signpost for the future of data protections in Iran.

If and when the stalled Data Protection Bill moves through the cabinet and Parliament, this issue of tech companies’ accountability must be raised over and over with Iran’s ICT Ministry. Proper data protections are essential to ensure the long-term privacy and security of the data of millions of users of domestic messaging apps — data which is currently stored on private servers partially funded by ICT Ministry-backed loans.

Big Money — Incentives Rolled Out for Domestic Messaging Apps Users

On the basis of SCC guidelines published in August 2017, we speculated that Iranian officials would begin to incentify Iranians to use domestic messaging apps by offering them exclusive access to services such as banking. While Fatahi’s document suggests that such incentives will comprise a method of drawing users to domestic messaging apps, the revelations and events of the recent months appear to be even more worrying than first considered.

Currently, there has been no discussion on how Iran is seeking to use domestic messaging apps to provide government services. However, in October, it was announced that Iranians going on their Arbaeen pilgrimage would need to use the Bale messaging app to order government-supplied Iraqi currency.

Users could submit their personal documentation to the Bale bot @dinarpaybot, and receive a certificate in-app that could be presented in order to receive payment. This service was only available through Bale, painting a worrying image of how Iran may seek to use government services to force Iranian citizens to download domestic messaging apps.

Bale is one of the first domestic messaging apps in Iran seeking to provide financial and governmental services. The app is a product of the SADAD Informatics Corp, which is 72% owned by the state-owned retail bank Bank Melli, 24% by the Informatics Services Company, 4% by the Investment Company of Iran’s National Development Group. The Bank Melli Iran Printing & Publishing Company and the Ayanadeh Pouya Plan & Development Company each own just one share.

Bank Melli claims to process the largest number of daily online transactions nationally, with more than 30 million customers nationwide. With Bank Melli rolling out additional services for customers through the Bale messaging app, it seems that the incentives for using the app will continue to grow over time. In turn, the fact that bank account data is linked to citizens’ state-recognised identities poses huge risks for user privacy in the long term.

What Next ?— Things to Watch, and Things to Change

Many internet freedom advocates and civil right campaigners over the last year have played a key role in pointing out the dangers of forcing domestic messaging apps on Iranian users. This level of pressure and scrutiny must be maintained even in light of slow user growth by the domestic messaging apps, and we should not feel complacent in the face of a narrative that celebrates their failure.

The last thing that digital rights advocates need to do right now is to pre-emptively celebrate the sluggish growth of domestic messaging apps over the last year. We would argue instead that Iran’s primary objective is not simply to stop users from using Telegram altogether, but is rather to eventually see all Iranians using domestic messaging apps alongside foreign ones.

In the past, this is the only way Iran has been successful in promoting domestic services above those of foreign platforms, and is the strategy that led to the rise of the video sharing platform Aparat. Although the filtering of YouTube helped create the conditions where Aparat could thrive, it is the platform’s unique content offerings, unique services such as TV live streaming, and faster, cheaper access for domestic users that made the service so popular in Iran.

The filtering of Telegram should force digital rights activists to pay more attention to Iran’s long-term strategy for promoting domestic messaging services. It is becoming increasingly clear that Iran’s strategy depends upon offering extensive financial support for domestic messaging services on the one hand, and imposing financial sanctions on Iranian users of foreign apps, by charging them higher ‘foreign data’ tariffs for using non-Iranian apps.

Additionally, if domestic messaging apps are to be fully integrated into Iran’s eGovernment and online banking ecosystem, then a large section of the Iranian public would have no choice but to download and use domestic messaging apps — especially given the high level of economic activity that took place on Telegram prior to (and since) its filtering.

The only way to have a hope of protecting Iranian users from surveillance and censorship is to provide them with the freedom to choose their messaging apps based on their own security and privacy needs.

There are two immediate steps which need to be taken to guarantee the privacy, security and civil rights of Iranian citizens:

• The SCC should immediately suspend its activities forcing domestic messaging apps on Iranian users. The filtering of apps such as Telegram and the promotion of apps with wholly insufficient data protection policies like Soroush and Bale undermines Iranian citizens’ right to privacy, and to access information freely. The data practices of services like Soroush are also deeply concerning, and we would express serious concern about such companies holding extensive data on user identities and online activities through the app.
• The Rouhani government must immediately bring forward a meaningful policy programme which guarantees the privacy and security of Iranian internet users. The worrying practices of domestic messaging apps over the last 10 months any consequences demonstrated that current legal framework and practices in Iran leave Iranian internet users vulnerable, and tech companies unaccountable.

The lack of progress on a ‘User Data Protection Bill’, and its apparent failure to even secure the support of Rouhani’s cabinet does not bode well for the future of data protections in Iran. As a consequence, the state’s ongoing entanglement with unaccountable messaging apps poses a significant threat that should be taken very seriously indeed.

Although Jahromi seeks to portray a public image an opponent of the filtering of Telegram and other platforms, he not received sufficient scrutiny for his role in bringing forward aggressive policies promoting unsafe and unaccountable domestic messaging apps.

Until Jahromi can deliver meaningful data protection legislation (as he promised he would in mid-2018), he should be viewed as a central architect of the current ICT policy programme that looks set to incorporate domestic messaging apps into Iran’s broader eGovernment ecosystem. In the coming months, we will continue to monitor this ambitious and worrying policy initiative, and hold Jahromi’s ICT Ministry to account.