This edition of FATAwatch covers the second quarter of 2019, between April 1 and June 30 (Q2). This is the second part in a series covering the activities of Iran’s Cyber Police (FATA), as reported on their official website. The first edition of the series — covering 1 January to 31 March (Q1) — and the methodology used to collect and classify the data, can be found here.
In the current edition we share some of our preliminary findings with the goal of publishing our detailed study after collecting further data over the course of one year.
In this quarter, 206 criminal cases were reported on FATA’s website which is a significant rise from 125 in Q1. During the second quarter of this year, there were 253 arrests associated with these cases, which is also up from 163 in Q1. Unlike Q1, the mobile app most frequently associated with criminal cases overall by FATA is Instagram, not Telegram.
Significantly, during this period, Iran was tragically ravaged by a series of heavy floods which caused widespread devastation across a large number of provinces resulting in at least 77 deaths overall. As part of its response, FATA sought to contain the flow of information on social media during these events by issuing a series of warnings about the spread of misinformation and fraud online.
Their response also included the arrests of a number of social media users and online account administrators. However, it remains unclear the dissemination of which content by these users was perceived as criminal by FATA.
In March, the head of FATA, Chief Brigadier General Kamal Hadianfar, was replaced by his former deputy, Brigadier Vahid Majid. There is very limited information available on Majid’s background and record within FATA, although owing to his previous seniority in the organisation, it is not expected that his appointment will usher in any significant policy shifts.
During the past three months Majid has maintained similar public engagements as the previous chief and also on delivering FATA’s response to high profile news events. For example, on 18 June, Majid took part in a meeting with journalists in Tehran, during which he emphasised the role of FATA in identifying 400 web pages in Iran which were involved in the sale of firearms.
He also added that since 30 April 2019, 38 people had been arrested in connection with promoting violence online in Iran (these statistics are not included in this report as they were only mentioned at a press conference and not reported on any official websites). This was largely in reaction to the murder of a cleric in April by an individual who had previously posted pictures of himself with guns on Instagram, causing Iran’s Supreme Leader to call on the police to deal with the the issue of promotion of violence online.
On 26 June Colonel Hossein Amirli was announced as Majid’s new deputy.
As noted above, during this quarter tragic floods struck Iran in April, killing 77 Iranians and causing more than $22bn in damage. Throughout the crisis, FATA issued numerous warnings relating to online misinformation, warning citizens not to trust reports appearing on social media platforms relating to the ongoing disaster. FATA also asked citizens to be especially wary of social media posts asking for donations, warning that a number of fraudsters were seeking to profiteer off the back of citizens’ generosity. This is not a unique occurrence, with FATA regularly issuing similar donation warnings during religious holidays.
The urgency of the situation, and the need to provide citizens with official updates and advice caused government officials to temporarily suspend their opposition to the use of the communication app Telegram. Government agencies soon began posting official notices on the platform, although it remained filtered — a tacit admission of the app’s continued ubiquity.
However, during this time FATA was also responsible for a harsh crackdown on social media users. Mass arrests of social media users by FATA on charges of “spreading rumours” and “provoking public reactions” are deeply concerning, as for many years similar charges have been used to target print media journalists across Iran. The fact that these arrests took place during a period of crisis and widespread misinformation should not exempt them from proper scrutiny.
One incident not shown in the data below is FATA’s arrest of 24 social media users in the Khuzestan province in April. A report published on 12 April refers to Khuzestan’s Chief of FATA’s comments, stating that 24 people were arrested for creation of “anxiety and unease in the public’s mind” and spreading “false rumours”. The news of the arrests were not reported on FATA’s official website and there is little information available on what exactly the supposed false news was.
FATA uses the same rhetoric to arrest social media users who criticise public figures. On 10 June, MP for the city of Arak, Seyyed Mehdi Moghadasi, thanked FATA for identifying the individuals responsible for publishing “false information” about public officials. There is no information about the people arrested other than the information released by FATA stating that they were administrators of a Telegram group with 5,000 members.
These announcements from FATA receive very little by way of public scrutiny, while at the same time individuals arrested under these charges are likely to be pressured not to publicly disclose the details of their case. In this sense, it is possible that FATA could bring cases against journalists, concerned citizens or campaigners with zero accountability. FATA’s reliance on oppressive laws such as Article 698 of the Islamic Penal Code allows them to use their powers to silence citizens who voice legitimate concerns about officials’ management of crises such as floods.
In the absence of transparency and legitimate oversight of FATA’s operations, it is impossible to assess whether the organisation is implementing these measures in a proportionate way to protect individuals’ reputations or rather to simply repress politically challenging speech.
Currently, FATA relies heavily on the Computer Crimes Law and the Islamic Penal Code for bringing charges unrelated to financial crimes. These two pieces of legislation have been used in high-profile cases such as the case of Amir Hossein Miresmaili and “Operation Spider” to suppress freedom of speech, and it is entirely possible that they are being applied by FATA in a similar way in the cases outlined above.
During Q1 and parts of Q2 of 2019 when Hotgram and Golden Telegram (Iranian copies of the Telegram app) appeared to be bypassing the ban on Telegram with some support from Iranian officials, FATA regularly raised concerns about the messaging apps, constantly linking them to criminal or immoral activities. However these domestic versions were finally shut down in June, meaning that since June Iranians have not had any state sanctioned way of accessing Telegram. It is to be seen if in Q3 FATA will continue associating criminal activities with Telegram or not.
However it is noticeable that In Q2 FATA has also started targeting Instagram and associating it with criminal activities. This coincides with some judiciary officials and hardliners in Iran seeking to ban the platform.
As documented here, the number of criminal cases associated with Instagram has risen from 21 in the Q1 of 2019 to 52 in Q2. This means that unlike the last reporting period, FATA has associated more crimes with Instagram than Telegram.
The most notable offenses which FATA targets on Instagram appears to be blackmail, gambling and harassment. As we previously reported, FATA continues to apply pressure on influencers on the platform, asking them to adopt FATA’s standards of “modesty” This also suggests that FATA views Instagram more as a cultural threat than one of cyber security or financial crime.
On 19 June, Colonel Amin Yadgarnejad who is the head of FATA in Kerman province claimed that 65% of cybercrimes since March were financial in nature. He also warned that compared to the same period last year, there has been an 80% increase in financial crimes.
From reviewing items posted on FATA’s website for Q2 of 2019, there appears to be a number of possible underlying causes that can be attributed to this rise. Amongst them could be the growth of Iran’s digital economy, diversity of ways to access social media platforms due to the filtering regime, peer-to-peer trading, and, Iran’s eGovernment project. For example on 30 June, FATA in Kerman Province warned of a phishing campaign pretending to be an official government page requesting financial aid for low-income families.
This highlights the urgent need for Iran to establish comprehensive data protection rules and bodies. In the absence of proper protections, ensuring the right of Iranian internet users and outlining the responsibilities of governmental bodies and private sector, the growth of eGovernment services and digital economy may further risk the security of Iranian internet users.
Notably, so far, FATA has not reported any criminal activity associated with domestic messaging apps. This may simply be due to the fact that these apps have a smaller user base than their mainstream global rivals but it’s also possible that FATA has few incentives to report on fraud and security breaches on state-supported apps that the government is working so hard to promote.
The only two Iranian platforms featured by FATA in this report are Divar and Sheypoor (both are classified advertisements websites).
It is also notable that there are only three provinces that have reported no arrests within the first six months of 2019. These are East Azerbaijan, Southern Khorasan, and Qom.
FATA has reported 310 criminal cases in Q1 and Q2, bringing the total for the first half of 2019 to 416 arrests. Note that these are only the arrests reported on FATA’s official website; as mentioned above, there are examples of news agencies reporting additional arrests that went unreported by FATA .
Although there were significantly more arrests reported by FATA in Q2, the proportion of financial crime remains roughly the same as the previous quarter, at around 60% of the total.
Looking at the results of FATAwatch for Q1 and Q2, there are some observations that we can report at this stage:
- It appears that not all of FATA’s activities are reported on their official website. As pointed out earlier the arrest of 24 social media users in the Khuzestan province did not appear on FATA’s website (and therefore omitted from numbers here).
- There is a clear correlation between FATA officials’ political messaging and crimes reported on their website. In this year’s Q1, when Telegram was the app most associated with cybercrimes, FATA officials were advocating in favour of shutting down Iranian copies of the app while during Q2 reporting period they have made a number of interventions against Instagram which is now the platform most associated with cybercrimes, replacing Telegram.
- FATA’s monitoring of social media accounts and arrests made in the name of “false news” poses a serious danger to freedom of speech and citizen journalism. This is especially troubling when it is used to protect public figures and relies on legislations that have over the years been used to limit the freedom of journalists in Iran.
What is clear is that FATA is not receiving adequate scrutiny and oversight from domestic forces. Armed with the most oppressive laws in Iran, they are rarely questioned about the details of the arrests made by them. It is also possible that those arrested by FATA for short periods are regularly urged to not publicise the details of their case, contributing to FATA’s ability to continue with their penalising of Iranians without appropriate oversight
