In the past month, Iranian authorities announced statutes and guidelines that will have a significant impact on the future of the internet in Iran. They include measures to drive users to platforms that emulate foreign products, track user activity on internet and intranet, establish tiered internet access, and generate income from the sale of VPNs.
The idea of filtered, trackable internet has been around for at least five years. The political unification of state apparatus under the current presidential administration has accelerated its implementation. As a result, crucial components of this initiative were actualized as of February 2024.
This report details the progress made in internet policy towards these goals in the field of internet policy. It also discusses the recent enactment of measures to prohibit the use of filter circumvention tools and the advancement of tiered internet access within the last month.
“Responsible” Internet Proposed
In a December 2018 interview with Hamshahri Newspaper, Abolhasan Firouzabadi, head of the National Cyberspace Center, proposed the idea of an “Internet 3” in which all users’ identities would be known. In this plan, everyone is accountable for what they do online, using their own identity to be active on the national information network. Firouzabadi said at the time that the plan’s implementation had been delayed by a year. Now, five years later, the policy and infrastructure have been prepared to roll it out.
The general strategy involves the government incentivizing citizens to transition to the national information network through economic incentives and assurances of better internet quality. For access to the international web, the government plans to distribute software that replicates key international applications, such as Telegram Gold, while also enabling the monitoring of user activities.
At the same time, the government is implementing filtering measures as planned. This will restrict access to specific groups, while state-supported VPNs will be utilized to generate revenue from users.. Furthermore, by integrating identity data from the Lifestyle System and leveraging the authority granted by the Verified Identity System law, the government will have the capability to monitor user activities beyond social media platforms.
Last month, the government also introduced an unprecedented VPN statute. This measure sets the terms for VPN usage and access tiers, along with facilitating entry to international platforms. Certain systems have been rolled out that may assist the government in launching the tiered internet, as well as tracking user activity.
Infrastructure deployed in the month of February that aims to support these initiatives is detailed below:
The Iranian User Verification System
This system, launched on February 19, records Iranians’ identity information from birth. According to Article 3 of the Guidelines for Data Privacy Protection issued by the Supreme Cyberspace Council (alternative link), the collection of identity information is the responsibility of the National Organization for Civil Registration. Per the Seventh Development Plan Bill, this system’s information is to be stored on a common database shared by governmental agencies named the “National Portal for Iranians”, through a communication channel of the national information network.
This data allows the Ministry of Communication to identify users, which is essential for providing tiered internet service and monitoring the content that users view.
The system ensures that user identities are known the entire time they are online.
The Ministry of Communication has legal backing to identify users. As the Supreme Cyberspace Council’s “Verified Identity System for Cyberspace” statute is presently written, every user of the national information network or smart government services must prove their identity.
More precisely, Section 1 of Article 3 of the statute says that every cyberspace interaction must be accompanied by a valid identity, and everyone on the national information network or networks connected to it must verify their identity. Section 5 adds: “All providers of services of a technical, economic (currency or financial), cultural, social, political or administrative nature in the country must act in the framework of, and in accordance with, the Verified Identity System for Cyberspace, and refrain from accepting or permitting interactions without a valid identity.”
Data Hosting Organization Guidelines
On February 10, the Supreme Cyberspace Regulatory Commission (a subsidiary of the National Cyberspace Center) passed (alternate link) the Data Hosting Service Organization Guidelines. They stipulate that all persons, real or legal, that wish to offer data, cloud, or hosting centers must verify their identities.
Data, cloud, and hosting centers referred to in these guidelines provide services to entities including domestic platforms like messaging apps. Data collected in these collaborations, including personal information, may be recorded in the People’s Lifestyle System.
The Seventh Development Plan Bill foresaw the development of this system, which records all information from people’s daily lives, both real-world and virtual, including driving and locations of traffic and commercial activity. Governmental organizations and databases are among the sources which contribute information.
Foreign Platforms Allowed, if “Governable”
On February 19, the Supreme Cyberspace Council announced (alternative link) the “Statute for Investigating Methods of Increasing Domestic Traffic Share and Countering Filter Breakers”. It stipulates that popular foreign apps should be made available to Iranian users by way of “governable platforms.” The process is similar to how Telegram is offered through secondary skins like “Telegram Gold,” which launched in 2018/2019, and whose users are said to have suffered numerous privacy violations.
The government’s lack of transparency and history with user data protection have heightened worries about more severe privacy violations. Fears are especially high given the fact that for a platform to be considered “governable,” it must monitor user activity and turn user data over to the government. With the Seventh Development Plan, this will be an obligation, not a choice.
Separating Sanctions Breakers and Filter Breakers
The Supreme Cyberspace Council’s new guidelines have categorized VPN software based on its purpose.
Article 5 of this statute stipulates that a “filter breaker” is software which “counters unjust foreign sanctions on technology” and should be provided free of charge by the Ministry of Communication and, if needed, entrusted to a private operator.
At present, this process is implemented by sites like 403 and SheCan, through which users can access sanctioned sites.
To counteract oppressive sanctions in the technical field, the Ministry of Information and Communications Technology of Iran is obliged to provide “sanctions breaking” tools at no cost. Additionally, the ministry is tasked with issuing the necessary licenses and establishing a conducive environment for the private sector, should they wish to engage in the development and distribution of tools designed to overcome sanctions.
Article 6 of this statue, meanwhile, prohibits the use of filter breakers which do not have a legal license. The Note to this Article assigns this task to a seven-person group to be chaired by the head of the National Cyberspace Center, with members from the Ministries of Communication and Intelligence, the Revolutionary Guards, and the Supreme Cyberspace Council. The group is accountable to the Supreme Cyberspace Council.
Article 6 of the “Statute for Investigating Methods of Increasing Domestic Traffic Share and Countering Filter Breakers” prohibits the use of filter breakers unless they possess a legal license.
The statute is designed to limit the use of VPNs beyond government control and to shape internet access according to its preferences. Additionally, the government aims to distribute filter breakers that enable tiered and traceable internet access, and to commercialize licensed VPNs for the general populace when deemed necessary.
The launch of systems like the Verified Identity System and other programs that have the backing of the law and the Seventh Development Plan to identify users facilitates the government’s ability to conduct segregated surveillance of the content accessed by each user.
Tactics like alternative skins for major software give users the false impression that they have access to foreign platforms: but they can be used to track activity and even, if necessary, cut off users’ access to others. Moreover, the strategy of enhancing local internet speeds while reducing costs compared to international access serves as additional leverage to retain users within the domestic network.
Trial and Error in Experimenting with Tiered Internet
Over the past several years, the government has built experience in planning and implementing the plan for tiered internet by providing it on a smaller scale. Internet packages for technology professionals, academics, and journalists are among the programs which have provided limited access to users based on their social position or job.
To obtain this type of access, the requesting party needed to submit their application to a government entity. Upon successful identity confirmation, they were granted access to select restricted websites.
Filterban research has found that the Computer Guild System Organization is responsible for presenting the list of technology professionals, while the Ministry of Science confirms university professors, and the Ministry of Islamic Guidance presents a list of qualified journalists to the Ministry of Communication.
It has also become clear that each of these professions has access to special kinds of sites and platforms.
Filterban does not have access to these requests in their raw form, and it is unclear what information, with what details, is required for users applying for tiered internet. We do know, however, that tiered internet is active for these individuals on particular devices. Moreover, they have no need for tools like VPNs to connect.
After the Ministry of Islamic Guidance confirms an individual is a journalist, tiered internet is activated for them. An informed source in Iran told Filterban on condition of anonymity that this access is partial, and sanctioned sites and services like the pathfinding software Viz remain unavailable. To use the internet for journalists, users do not have to open special software, and the internet is automatically unfiltered. The source also said that journalists at state news sites, given their need for such sources, use this same system.
