By Amir Rashidi, James Marchant, and Kaveh Azarhoosh
Since the assassination of Major General Qasem Soleimani on 3 January there has been a significant escalation of political tensions inside Iran. Particularly since the tragic shooting down of Ukraine International Airlines Flight 752, and authorities’ failed initial attempts as misinformation and misdirection, popular anger has begun to boil over into the streets once again.
Although we have not yet seen the imposition of a protracted total internet shutdown like we observed during the fuel price protests of November 2019, we have seen a number of indications that authorities are implementing targeted disruptions of citizens’ access to the Internet.
Given Iran’s recent track record of responding to popular dissent, and in light of the total internet shutdown imposed during the unrest in November, Small Media is deeply concerned about the possibility that Iran will impose further internet controls and disruptions if protests in Iran continue to grow.
With serious questions still to be answered by Iranian authorities regarding the decision-making process in November that led to the nationwide internet shutdown, it is crucial that the Iranian government, the National Security Council, the ICT Ministry, the Supreme Council for Cultural Revolution, and the Supreme Council for Cyberspace are all held to account for any attempts they make to restrict access to the global Internet.
Small Media urges the Iranian government not to restrict citizens’ right to protest, or to undermine the safety and security of protesters in Iran by attempting to disrupt the access to the internet. We will continue to monitor any interruptions to internet access in Iran, and plan to release our full documentation around January’s service disruptions later in the month.
Below is our documentation of the internet disruptions recorded since 6 January. A detailed report outlining incidents throughout January will be published on Filterwatch at the end of the month.
There were disruptions to Telecommunication Company of Iran (TCI) services from 18:53 until 22:30 local time. News websites inside Iran also confirmed these disruptions. According to official reports, the service outages were caused by a technical issue which was later resolved.
Oracle Intelligent Map showed a large dip in traffic on AS25184 Afranet and AS1756 Shiraz Hamyar Co, signalling disruption on those ISPs. The reason for these disruptions is unclear.
From around 18:00 local time, network disruptions were observed — firstly to 3G and 4G mobile services around Azadi Square in Tehran, and then on Telecommunication Infrastructure Company, affecting users nationwide.
Our investigation shows that Instagram was the platform mainly affected by this disruption:
Based on Oracle Intelligence Map, Iran’s international internet connections were disconnected twice on the same day:
Around 1:34PM we observed significant levels of packet drop on WhatsApp. This indicates the same pattern that we saw during the November internet shutdown.
Firstly, we have seen that Iran tries to block all channels of communications which are still unfiltered (including WhatsApp). In the event that protests escalate, and the blocking of circumvention tools or channels of communications is viewed as insufficient, we expect that authorities might move to further disrupt the internet or finally impose a total shutdown.
Around 17:20 local time, MCI and Irancell services were disrupted — mainly around Azadi Square and other areas that saw significant numbers of protestors on the streets. Based on data collected from three different data centers across Iran, MCI was completely disconnected from the global internet.
Mobile data services remained suspended in some parts of Tehran, including continued disruptions around Azadi Square.
Oracle Intelligence Map shows a significant internet traffic shift from January 9–13, with a total impact score of 191.4 (representing a very significant service disruption). During this period most circumvention tools were also filtered.
We observed a total shutdown lasting around 15 minutes starting at 17:19 local time in Tehran.
