Policy Monitor

Policy Monitor — April 2020

New details on legal VPNs emerge, as the Education Ministry rolls out a new e-learning app.

The COVID-19 crisis continues for another month, claiming lives and devastating families across the globe. In Iran, the rate of infection is continuing to grow daily, with the total official number of infections reaching 109,276 and the total number of deaths coming to 6,586 to date. Though according to the Health Ministry’s statistics suggest some decline in the number of cases, some reports have questioned whether the true figures could be much higher than the official totals.

With President Rouhani easing some of the already limited social distancing and quarantine rules in April, there is a risk that the rate of infections will spike, causing a “second wave” in the weeks and months ahead. But facing a lack of appropriate social security measures and an already strained economy, many have no choice but to continue their lives as usual.

Iran has become increasingly reliant on technology to mitigate the effects of social distancing measures, with a new e-learning app deployed this month despite concerns around its accessibility. This roll-out has ignited fresh debate on Iran’s digital divide, and the limited access to technology enjoyed by those on the country’s social and economic margins.

Meanwhile, freedom of expression online remains restricted, with reports of thousands of individuals being arrested for “spreading rumours” online. Although limiting the spread of disinformation is a valid objective, this aim should not be achieved through such a punitive, non-transparent and far-reaching crackdown on Iranian users, and instead would be better served by opening up space for critical, independent journalism and credible sources of information. The lack of transparency and sheer number of arrests suggests that security and law enforcement forces in Iran are not seeking to fight disinformation online, but rather are focused on further shrinking virtual spaces for dissent.

Our monthly Network Monitor supplements this report with a technical analysis of network disruptions and internet shutdowns. Take a look at it to get a better sense of how COVID-19-related slowdowns affected Iranian users.

Supreme Council for Cyberspace Meetings Delayed “Due to COVID-19”

In an interview on 21 April Mohammad- Hossein Entezari, a member of the Supreme Council for Cyberspace (SCC), discussed the lack of progress in the macro-planning for the National Information Network (NIN). The NIN progress and planning review which was assigned to a team of specialists at the National Centre for Cyberspace by the SCC, began work in February this year.

According to Entezari, some members of the SCC have held online meetings in relation to “certain issues”, meetings headed by the President or relating to NIN planning review have not taken place “due to the COVID-19 crisis”. He added that “no SCC meetings have taken place since the spread of Coronavirus began”.

The SCC is required to meet every six weeks, however it appears that no official meetings have taken place since February. The mandate for the SCC, which is issued by the Supreme Leader was last renewed on 5 September 2015 for a period of four years has now expired and has not been formally renewed .

Judiciary’s Head of Cyberspace Affairs is Replaced

On 20 April it was confirmed that Javad Javidnia, the Deputy Prosecutor General responsible for Cyberspace, was leaving his position. It is unclear whether Javidnia has resigned or was removed from the role, however in a note posted on his channel on domestic messaging app Soroush, Javidnia attributed the move to “not being able to follow [the] Supreme Leader’s orders”. He went on to criticise the “lack of effort from those in charge” in following Khamenei’s line, especially lamenting the continued availability of Instagram, which he views as a major challenge to a harmonious society and the revolution.

Javidnia, who has been serving in the position since October 2018 — and in its attached capacity as the Secretary of the Committee for Determining instances of Criminal Content (CDICC) — has played a major role in issuing a number of filtering orders such as the filtering of the Google Play Store and was a vocal supporter of the November 2019 internet shutdown. He has also been behind the roll-out of the process for the sale of government controlled “legal” VPNs.

On 25 April it was confirmed that Javad Babaei has replaced Javidnia. Babaei previously served as the Head of the Computer Crimes Court. During his time in the role, he was reportedly part of the Islamic Revolutionary Guard Corps (IRGC) and Iran’s Cyber Police (or FATA) Operation Spider I and II, which saw the surveillance and mass arrest of Iranian social media users and models not wearing a headscarf. Javidnia was also involved in these operations prior to becoming the Head of Cyberberspace Affairs at the Judiciary.

There are no indications that the new appointment will bring any dramatic changes to the current scale of content filtering, however Javidnia’s explanation of the move does suggest that there has been some level of resistance among policy-makers to further extending the scope of filtering to additional social media platforms.

Legal VPNs Enter Planning Phase, In Preparation for Roll Out

On 14 April, the Secretary to the Supreme Council for Cyberspace (SCC), Abolhassan Firouzabadi announced that the CDICC has drafted the regulation relating to legal sale and use of VPNs. He added that the ICT Ministry will also be involved in executing the new “legal VPN” scheme.

According to a recent interview with Javidnia prior to his departure from his position as the Head of Cyberberspace Affairs at the Judiciary, university teachers, students, journalists, doctors, security and judicial organisations and certain professions which require access to filtered websites may apply to receive legal VPNs. A fee will be payable by those who are approved to receive the VPN, which will be set by the Communication Regulatory Authority (CRA).

He added that while the legal criteria for legal VPNs have been drafted, the technical aspect of rolling out the VPNs and assigning operators and licences has been assigned to the ICT Ministry for consideration within the second phase of the plan. However, Javidnia also mentioned that there have been some delays in progress at this stage due to “low attendance” at CDICC meetings, with some MP members attending “other meetings in their constituencies” on Thursdays, when the CIDCC is scheduled to meet.

Discussions around the state regulation of VPNs have been ongoing for some time, although discussions took a more serious turn as we reported last October,with the ICT Ministry providing a list of approved VPN vendors to the National Centre for Cyberspace.

The sale of state-regulated “legal” VPNs is in line with what we have observed as an emerging structure developing in Iran’s internet known as “layered filtering”. This system allows different sections of society to have different levels of access to the global internet, and to certain online services as assigned by the government. This not only violates the digital rights of Iranians, but this approach also risks entrenching existing socio-economic divides by creating a privileged class with some level of access to the global Internet. We have already written about the potential impacts of this “layered filtering” model upon Iranian internet users.

As well as allowing access to filtered websites, VPNs are also important online privacy and security tools, and government control and monitoring of these tools seriously undermines their benefits. Government interventions to regulate VPNs must be halted immediately, and citizens must be made aware of the risks that such tools pose to their online privacy.

Iranian E-Learning Platform “SHAD” Risks Leaving Students Behind

On 9 April the Ministry of Education announced the launch of the new domestic e-learning platform officially known as “SHADAP” (and also commonly referred to as “SHAD”) is available to download via shaddl.medu.ir. Following the reiteration of the ban on the use of foreign messaging apps by public bodies, government organisations, schools and universities by the judiciary this February, the opportunity is being used to enforce and normalise the use of domestic analogues. However, SHADAP is already causing concern and challenges among users and digital rights activists.

On 14 April the Iranian refugee protection NGO HAMI raised concerns about the accessibility of the app by Afghan refugee children, as the app requires national ID numbers to be entered before they can be accessed, which refugee children often lack. According to HAMI, the Ministry Ministry of Education has now “resolved” the issue to allow foreign children to access the app.

The app was created in collaboration with Roobika, a domestic messaging app, which has also raised security issues among users. Other concerns, such as low connectivity speeds and technical issues, lack of access to smartphones and internet by students, remain major concerns by teachers and students. According to the Education Ministry the government is “looking into” providing free internet connections and tablets” to students without existing access.

Iranians Face Up To 30% Increase in Mobile Phone Prices

According to a report by Iranian Magazine Peivast on 27 April, the price of mobile phones have increased by between 20–30% compared to the previous year. Some have attributed the price increase to the sudden demand for devices for the use of the SHAD e-learning application, while others have claimed that the increase is due to stock shortages and import limitations.

Regardless of the reason for the price increases, many families now face the added financial burden of acquiring smartphones and other devices in order to access online learning platforms including SHAD which is an additional strain on vulnerable groups who have been the most financially impacted by the COVID-19 pandemic.

The current conditions could mean that the competitively priced domestic smartphones could become more popular among users, posing risks for privacy and security in the absence of data protection and privacy laws.

Journalists Arrested for Allegedly Posting a Cartoon Mocking Religious Figures

On 23 April two Iranian journalists, Massoud Heydari, the Managing Director of the Iranian Labour News Agency (ILNA), and Hamid Haghjoo, the administrator of ILNA’s Telegram channel were arrested for allegedly publishing a cartoon on the news outlet’s Telegram channel criticising religious figures touting unscientific remedies for COVID-19.

According to reports, Heydairi has been released on bail while Haghjoo is being detained pending an investigation into the event. In a statement, ILNA has denied any involvement in the publication of the cartoon.

A number of other journalists and online activists have either been arrested or have received warnings relating to their coverage of the crisis. According to reports a number of journalists from the city of Saqez in Kurdistan Province were summoned or received warnings from the police in February, including Fardin Mostafaei, the administrator for Telegram news channel “Saqezroodaho” who was questioned by the police including on his his reporting on the number of infections. Some other online activists from the province received warnings from the police in relation to suspected deaths from COVID-19 and warnings about inadequate health care conditions in the city.

Along with the safety of prisoners with the spread of COVID-19, freedom of expression and freedom of the press remains crucial especially during times of crisis. The journalists detained must be released immediately and journalists must be able to perform their duties without fear of arrest and intimidation from the government. The ILNA Telegram channel remains accessible.

3,600 People Arrested for “Spreading Rumours Online”

On 29 April Aboulfazl Shekarchi, a senior Spokesperson for the Armed Forces announced that to date 3,600 people had been arrested by the Police and Basij forces for “spreading rumours in cyberspace”.

This is an incredibly high number of arrests, and there is lack of transparency as to the definition of “rumours” and charges of these individuals. There must be full transparency from authorities about the charges being brought against detainees, and unwarranted arrests and detentions should be halted immediately. Iranians’ right to criticise the government’s response to this ongoing crisis must be upheld, without the fear of prosecution and harassment from authorities.

US Tech Sanction Enforcement Extends to Non-US Companies

On 16 April it was reported that the Treasury Department’s Office of Foreign Assets Control (OFAC) has settled a lawsuit against Swiss IT service provider Société Internationale de Télécommunications Aéronautiques SCRL (SITA) for $7.8 million for “apparent violations of the Global Sanctions Regulations, , 31 C.F.R. part 594 (GTSR)” SITA provides services to commercial air transportation industries, their clients also included Iranian airline companies Mahan and Caspian Air. Both airlines are sanctioned by OFAC due to their “involvement in terrorism”.

Though SITA is not US-owned, it is believed that the company used US based servers and US made software for the services they provided to the Iranian airlines, leading to OFAC taking legal action against SITA.

On 12 October 2011 the US Department of the Treasury announced sanctions against Mahan Air for providing “ financial, material and technological support to the Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF).” Caspian Air was sanctioned on 29 August 2014 for “[providing] support to IRGC elements by transporting personnel, and illicit material, including weapons, from Iran to Syria”.

About the author

Melody Kazemi

Filterwatch