On February 13, 2024, a hacker group called “Rebellion Until Overthrow” leaked parliamentary documents and emails that revealed the Islamic Republic’s internet censorship and surveillance practices. The documents showed how the government used urban cameras to surveil and suppress protesters, and how it has a vision to limit internet access to the global internet for anyone who is not part of the ruling elite. The letters below illustrate the mindset of Iranian policymakers who justify and enforce these internet restrictions.
Previously, Filter Watch had predicted these restrictions based on technical data in our reports. The leaked documents confirm our findings.
This report examines the details of the documents that affect the state of internet access in Iran.
Summary of Reviewed Matters; What Do the Letters Say?
The following section will examine three letters and summarize the parts that are relevant for this analysis.
The Deputy Minister of Information wrote a confidential letter to the First Vice President, Mohammad Mokhber, on November 26, 2022. The letter analyzes the impact of internet shutdowns on people, businesses, and public and private sectors in three parts: assessing the pros and cons of internet disruption and proposing ways to improve conditions. The letter uses a formal and bureaucratic tone, and cites data and information from official sources or intelligence reports.
Key points from this letter:
- Criticism of “poor governance in cyberspace” and the “general public’s” reluctance to embrace native messaging apps.
- Confirmation of WhatsApp and Instagram being blocked by the decision of the Supreme Council of Cyberspace (SHAK).
- The impact of Instagram filtering on home businesses, women, and companies.
- The effect of internet disruptions on the provision of government services.
- Confirmation of the use of urban cameras for surveillance and control of citizens.
- The impact of internet disruptions on Iran’s interactions with the world.
- The impact of internet disruptions on migration patterns.
- Examination of international communications status in case of strengthening the National Information Network.
- Confirmation of the use of urban cameras for “target finding” and suppression of government opponents.
- Criticism of VPN sales and capital flight from the country.
- Confirmation of the reduction in international traffic bandwidth.
- Mention of Starlink internet as a “new threat against the Islamic Republic.”
- Emphasis on the development of the National Information Network, fiber optics, and native mobile software by the government, with a sense of urgency.
A highly confidential letter from Major General Hossein Salami, Commander-in-Chief of the IRGC, to Ebrahim Raisi, the President of the Supreme National Security Council, dated December 21, 2022, discusses the filtering of foreign messaging apps and emphasizes the need for greater internet restrictions. This letter is written in a poetic language, without reference to documentation.
Key points from this letter:
- Confirmation that the Supreme National Security Council ordered the filtering of foreign messaging apps and social networks and demanded their permanent ban.
- Criticism of the “unregulated cyberspace” and insistence that blocking platforms is not a temporary or tactical solution but should be permanent.
- Migration of half of the users to domestic apps following the expansion of filtering, with the suggestion to continue blocking these networks to complete the migration to domestic platforms.
- The possibility of allowing foreign platforms to operate in a “managed” competitive environment.
- Confirmation of a 50% reduction in international bandwidth and emphasis on the potential for further reductions in international bandwidth.
- The need for more extensive filtering and support for domestic platforms.
A confidential letter from Ali Bahadori Jahromi, spokesperson and head of the Information Council, to the Ministers of Economy and Industry, dated October 29, 2022, about banning the importation of Starlink satellite internet equipment due to their role in protests and facilitating communication among people. This letter acknowledges the entry and establishment of Starlink internet.
Internet Shutdown by Order of the National Security Council
In a letter written by the Deputy of “Information and Economic Security” at the Ministry of Intelligence, dated November 26, it was emphasized that during the “Woman, Life, Freedom” protests in Iran, messaging apps WhatsApp and Instagram were filtered by the order of the National Security Council or SHAK.
SHAK (Alternative link), or the National Security Council, is a subset of the Supreme National Security Council and an institution that includes representatives from the ministries of Communications, Intelligence, the Revolutionary Guards, and military forces, chaired by the Minister of Interior. Its responsibility is to review significant incidents and developments in domestic security and make decisions in the realm of security issues.
In 2023, for the first time, evidence emerged that confirmed, according to officials’ admissions, Filter Watch had accessed information indicating that the internet shutdown was carried out by order of this institution. Evidence also showed that SHAK ordered and the regulatory authority (Regulatory Organization) implemented the internet outage and disruption in Sistan and Baluchestan province, which started in October 2022.
Internet Disruption in Sistan and Baluchestan; Awareness of People’s Suffering
The Deputy Minister of Intelligence wrote the letter to the First Vice President two months after the internet outage in Sistan and Baluchestan began on Bloody Friday. The blackout lasted for over a year.
The Deputy Minister of Intelligence, in paragraph 12 of his letter, refers to the “internet disruption” in Zahedan, which caused the “disconnection of secure communication” for the Pakistani embassy with its domestic sources. As a result, issuing Pakistani visas to international transportation companies, drivers, traders, and Iranian businessmen has been problematic. This letter validates Filter Watch’s assessments of the situation in Zahedan over the past year regarding the extent of disruptions. Although none of the country’s officials had commented on these disruptions, it indicates that high-level officials were clearly aware of the consequences of the internet blackout in Zahedan, and were even concerned about the increase in public dissatisfaction arising from it. Nonetheless, one year after this letter, severe internet disruptions and blackouts in Zahedan continued.
Technical details and evidence about how this process was executed have been examined in the article “Sistan and Baluchestan: Victims of the Organized Use of the SIAM System.”
Bandwidth Reduction: Confirmation of a Fifty Percent Reduction in International Bandwidth
Two letters in the leaked documents clearly confirm the intentional cut in the international internet bandwidth. The bandwidth cut was part of the Protection bill, which sought to shift bandwidth from foreign platforms that used a lot of data to domestic ones, based on a policy framework document that set the requirements for the National Information Network. The Protection Plan had envisioned this ratio of foreign to domestic traffic as 30 to 70.Despite the lack of approval for the Protection Plan, many studies, such as the E-Commerce Association’s reports, confirmed that the bandwidth cut was intentional. At the same time, Raisi’s Ministry of Communications does not share bandwidth data publicly, which would allow for verification of this claim. The Regulatory Authority’s chief, Amir Mohammadzadeh Lajvardi, said in a meeting with the E-Commerce Association on February 13, 2024, about internet quality, that there was no legal ban on providing bandwidth. However, the Raisi administration has not given any statistics on this issue.
Amir Mojiri, an Iranian user who has exposed the government’s internet policies and demanded transparency over the years by filing information requests to the government through the Government Transparency System – a system for accessing public documents and information – tweeted on May 9, 2023: “In addition to the secrecy of the country’s international traffic statistics, the traffic statistics of Iranian messaging apps are also #classified. Based on the statistics provided by various officials, the ‘number of active monthly users’ of Bale, Eitaa, and Soroush has increased by 4 to 12 times in 1.5 years. The number of Rubika users has also reached 40 million.”
The interviews of the government officials showed their attitude towards cutting the bandwidth of international traffic. For instance, on May 10, 2023, Isa Zarepour, the Minister of Communications, stated on the sidelines of a cabinet meeting that 90% of the country’s needs are met by native platforms, and the maximum requirement for international communications is ten percent.
The hacked parliamentary documents show that this policy has been carried out, and they also reveal how much the international bandwidth has been cut.
The letter from the Deputy Minister of Information and Economic Security to Mohammad Mokhber subtly mentions the “reduction of internet bandwidth,” which has led to “disruption in service delivery” and, according to users, will be seen as a “accusation of government inefficiency.”
Disruptions in internet access and tampering with communication routes not only affect ordinary citizens but also hamper the operation of government services. This is because many of these systems providing electronic government services require access to foreign online services and connections to the internet for optimal service delivery.
In the “highly confidential” letter from Major General Hossein Salami, the Commander-in-Chief of the IRGC, to Ebrahim Raisi as the President of the Supreme National Security Council, a 50% reduction in international bandwidth is mentioned, emphasizing that further reductions are necessary to support domestic platforms and complete the migration of users to native platforms.
The inclination and emphasis of the Ministry of Intelligence and the IRGC on further internet restrictions
The leaked letters show that the Islamic Republic’s intelligence and military organizations pursue limiting internet access. The Ministry of Intelligence, in a letter to the First Vice President, has requested that the development and launch of the National Information Network and native mobile applications be “urgently” prioritized by the Ministry of Communications. Additionally, the enhancement of the fiber optic network is emphasized.
In a letter written by the Commander-in-Chief of the IRGC to Ebrahim Raisi, these restrictions are supported in the form of further bandwidth reduction and the continued filtering of social networks. He states that the blocking of social networks should not be a temporary or tactical measure but must continue for several years until the migration of users to domestic platforms is “complete.”
Salami acknowledges in this letter, without referring to any specific evidence or data, that domestic platforms reached a position in attracting audiences within three months that foreign messaging apps have achieved over several years.
The plan that the Commander-in-Chief of the IRGC envisages after the completion of the migration process to domestic platforms is to create a competitive environment but within restrictive frameworks; creating a competitive space by adopting appropriate policies to manage foreign capacity in a controlled manner!
While Major General Hossein Salami, the commander of the IRGC, praises the significant user adoption of domestic platforms, the Deputy Minister of Communications criticizes the poor governance of cyberspace and the public’s reluctance to use native messaging apps.
The existence of these directives, presented in the form of suggestions, indicates that these two bodies are working towards completely cutting off citizens’ access to internet content and replacing it with the National Information Network. In this context, the contents of these letters confirm that due to this approach, the development pace of the National Information Network and fiber optics has increased in the new government, with the Minister of Communications personally presenting related reports; an approach that was unprecedented in previous terms.
Statements by high-ranking officials of military and intelligence organizations about internet access raise concerns about an increase in militarization and surveillance of the internet. Militarization and monitoring of citizens’ activities were significant parts of the Protection Plan.
The existence of such approaches heightens concerns about increasing militarization on the internet, as one of the clauses of the Protection Plan.
Satellite Internet; Implementation of the Ministry of Intelligence’s Order by the Government
Satellite internet has been a focal point for various sectors of the Islamic Republic’s government, as indicated in the letter from the Deputy Minister of Intelligence to Mokhber and also in the letter from Ali Bahadori Jahromi, the government spokesperson, to Ehsan Khandouzi, the Minister of Economy, and Reza Fatemi Amin, the Minister of Industry, demanding the urgent prevention of Starlink equipment imports into Iran.
In Bahadori Jahromi’s letter to the Minister of Economy, citing “received information,” he reports the entry of Starlink and Helium satellite internet equipment into Iran without legal restrictions.
Further in the letter, by juxtaposing the claims of the Islamic Republic’s intelligence agencies and quotes from Western officials, it is considered an effort to facilitate access to internet and communication tools and systems “an attempt to maintain the communications of agitators, manage the media of disturbances, and significantly increase protests.” With such reasoning, Bahadori Jahromi has requested the Minister of Industry, Mine, and Trade to urgently prevent the importation of satellite internet equipment into Iran. Additionally, this letter marks the first mention of “Helium,” a blockchain-based communication network, although no subsequent paragraphs of the letter mention any prohibition regarding it.
The letter from the Deputy Minister of Intelligence to the First Vice President, written one month after this order, continues to express concern over the existence of satellite internet, considering it “one of the new threats against the Islamic Republic” originating from the United States, which is rapidly completing. If expanded, it warns, the volume of threats and crimes in various areas will increase.
This is occurring while the government is developing plans to launch communication satellites, claiming they can provide satellite internet services in Iran while adhering to the country’s national regulations.
The Deputy Minister of Intelligence has deemed “negative approaches” or crackdowns and “passive reactions” or inaction as ineffective responses. Instead, it has been stated that “the best and most competitive internet services” should be offered to encourage the use of the “National Information Network.”
Among the non-negative government responses to Starlink internet, the Islamic Republic has filed a complaint with the International Telecommunication Union (ITU) against Starlink’s operations in Iran. The Islamic Republic argues that Starlink has not received a license to operate in Iran, deeming the company’s services in the country unauthorized. The ITU has found Iran’s documentation sufficient to prove the presence of Starlink terminals in Iran against the country’s territorial laws. Miaan Group, along with several human rights organizations, wrote a letter to the Secretary-General of the ITU protesting such an approach, stating that the Islamic Republic’s behavior in cutting off the internet contradicts the ITU’s constitution. Furthermore, they asked the Secretary-General to take an active stance against the censorship and suppression of the internet pursued by the Iranian government.
