Welcome to the first edition of FATAwatch — Small Media’s new quarterly report seeking to scrutinise the operations of Iran’s Cyber Police (or FATA), and to better understand their growing role in monitoring and regulating Iran’s online environment.
FATA was founded in 2011 in the aftermath of the digitally-empowered mass protests that followed the disputed presidential elections of 2009. Dogged by controversy in its early years, and implicated in the death of blogger Sattar Beheshti in 2012, FATA has in recent years maintained a comparatively low profile. Regardless, in October 2018 FATA announced that it had arrested a total of nearly 75,000 people in its seven years of operation.
Despite this striking figure, we have seen relatively little scrutiny applied to FATA’s operations — especially compared to other organisations such as the ‘Iranian Cyber Army’ or the Iranian Revolutionary Guard Corps, which target diaspora-based activists and foreign governments.
Although cyber policing units often undertake legitimate work countering online crime, we believe that owing to its history and Iran’s wider record on information controls, FATA requires a higher degree of scrutiny than it’s currently being afforded. This is the gap that FATAwatch aims to fill.
This first edition of FATAwatch covers the public operations of FATA from January–March 2019.
Want to learn more about FATA? Our team recently produced an extensive report on FATA’s origins and operations —read it here.
Our work here aims to demonstrate the extent of FATA’s operations nationwide, while highlighting disparities in enforcement across different regions and political contexts inside Iran.
The data presented in this report is collected from the official FATA website, and is based solely on the reports published by FATA itself. Therefore the figures presented here should not be understood as documenting the total number of arrests made by the agency, but instead as a reflection of how FATA chooses to publicly present itself and its law enforcement priorities.
In these reports, we will also monitor the charges brought against individuals detained by FATA, which can for the most part be classified within the following three groups:
- Illegal Products & Services — These charges include the sale of goods such as weapons and drugs, as well as services including gambling or prostitution.
- Financial Crimes — These are mostly linked to phishing, online scams, and other types of fraud.
- Moral Crimes — These charges include stalking, spreading rumours, revenge porn, or other crimes involving the publication of content deemed immoral or illegal. Some of these crimes will have had financial motives, but FATA has instead presented them as moral crimes.
In each province we record the numbers of those that FATA has arrested and/or identified and referred to the judiciary. We also monitor the apps and websites that FATA associates with reported criminality. This enables us to develop a better understanding of the reach of the organisation’s monitoring, and their approach to and perceptions of different apps and platforms.
In addition to the quantitative presentation of FATA data, we’ll also highlight any notable public statements or security warnings issued by FATA officials during each quarter.
So that’s how we got the data. Now, let’s see what we found.
One of the clearest findings from the arrest data is that there’s a very uneven distribution of reported arrests among provinces. Hormozgan saw the highest number of arrests by quite some margin, with 24 people identified or arrested. It should be noted that 16 of these arrests came from a single case relating to financial crimes in January 2019.
This data could suggest that Hormozgan, Isfahan and Khorasan Razavi implement tougher law enforcement strategies than other provinces, or it could just be that their provincial forces have a more active an engaged media team. As FATAwatch continues, and we collect more long-term data, we should be able to develop some deeper insights into these nationwide dynamics.
Regardless, we can understand from these nationwide figures that FATA has been presenting itself firstly as operating to counter financial crimes, with these reported crimes typically outweighing morality-related crimes or those relating to illegal services.
In the three provinces with the highest number of arrests financial crimes are the most heavily reported. Telegram and Instagram are the two platforms that seemingly received the greatest level of scrutiny within this group, as well — though in Isfahan and Khorasan Razavi there were also a high number of reports that failed to specify a particular platform.
‘Other’ platforms are those which were either not determined by name, or else described in very vague terms. This category will include reported crimes conducted via email, malware, and other indeterminate methods.
The arrests and identification of criminals was heavily linked with the platform Telegram. There could be a couple of reasons for this.
Firstly, authorities have an incentive to make noise about criminal incidents on Telegram — the app is filtered, and so by emphasising the prevalence of criminal activities on the platform, authorities further justify the filtering of the app.
Secondly, many of the arrests were linked to activities taking place on public groups, and so it may well have simply been easier for authorities to identify online criminals on Telegram than on alternative platforms.
By comparison, the record of arrests links Instagram more closely to morality-related crimes. A number of these arrests were made relating to harassment or online stalking. In all of the cases mentioned, the victim (or victims) were female.
The only two Iranian platforms that were named as being used for criminal activities were Sheypoor and Divar — two sites used for sharing classified advertisements. All of the crimes noted on these platforms related to financial crimes.
The high prevalence of crimes committed on ‘Other’ platforms could be reflective of a couple of things — firstly, the vagueness of a number of FATA’s press releases, and secondly, the likely ongoing prevalence of fraud and exploitative criminal activity using other methods such as email, malware, and malign apps.
During this reporting period, a handful of arrests fell outside the three categories of criminal activities that we have formulated, and are categorised as ‘Other’ crimes in our dataset:
5 January 2019 — Whistleblowing
FATA (Khuzestan) reported the arrest of a number of Iranians for publishing the “confidential documents” of an organisation on WhatsApp. FATA did not specify whether the institution referred to is a private company or a public institution.
11 March 2019 — IRIB Poll Manipulation
FATA announced the identification and arrest of an individual behind the manipulation of a poll conducted by IRIB.
31 March 2019 — Khuzestan Bar Association Hacked
FATA (Khuzestan) announced that a teenager was arrested for hacking the website of the province’s Bar Association. According to FATA, the teenager carried out the crime in order to “demonstrate his skills”.
FATA also made a number of announcements and warnings over the course of the first quarter:
1 January 2019 — Financial Motives For 80% of Cyber-Crimes
Colonel Hussein Ramazani of FATA announced that more than 80% of cyber-crimes committed in Iran have financial motives.
5 January 2019 —FATA Warns of Illicit Gambling
The AFC Asian Cup saw a rise in FATA’s warnings on gambling online. Unsurprisingly, many of those offering illegal gambling opportunities online were seeking to attract Iranian football fans.
General Warning — Harassment on the Rise
In this quarter there have been a notable number of cases reported by FATA in which women have reported harassment or blackmail, particularly relating to women being threatened with the release of their private photos. In response, FATA officials strongly advised women not to post private photos online, as they may be used against them.
General Warning — FATA Issues Warnings on Flood Misinformation
On a number of occasions in this reporting period, FATA warned the public against spreading rumours or inaccurate news regarding the floods in Iran.
In this first edition of FATAwatch, we’ve sought to demonstrate the depth of the data available to us through monitoring FATA’s public reporting of arrests and criminal cases.
The data we have gives us hints about the possible existence of a few stories, but we’ll need more data before we can begin to develop any solid conclusions about long-term trends. Nonetheless, here are some of the things we’re going to be looking out for in future instalments of FATAwatch:
- There are some big variations in arrests per province — Our dataset is far too small to say anything meaningful about province-to-province variations at this stage, but we’re interested to see whether Hormozgan, Isfahan, Khorasan Razavi, Hamadan and Tehran stick around at the top of our list.
- Telegram is FATA’s main target — By a long stretch, Telegram is the platform cited most frequently by FATA as a venue for cyber-criminals. This is logical — the app was used by as many as 40 million Iranians prior to its filtering in 2018, and it remains incredibly popular today despite being filtered.
- Instagram marked out for morality-related crimes —The majority of criminal activity reported on Instagram relates to ‘morality-related’ crimes. The nature of FATA’s reporting on Instagram contributes to state officials’ broader narrative about the platform, casting it as a moral threat to Iran’s youth.
In future editions of FATAwatch we’ll also be digging a little deeper into the national and local political contexts around the outliers in our dataset, and will offer some comparative analysis of arrest data quarter-on-quarter.
It’s our hope that this report will provide an opportunity for us to apply proper scrutiny to the work of Iran’s Cyber Police. We want you to help guide FATAwatch as it develops — if there are questions you’d like us to look into for the next edition, or comments on this report, then please flag them up in the comments!
