An ISPA poll published last month showed that Islamic Republic internet filtering policies have failed. Despite official restrictions, platforms like Telegram, WhatsApp, Instagram, and YouTube remain widely used among Iran’s college students. However, government decision-makers persist with these broad filtering measures, coupled with pricing policies that charge more than double for foreign internet traffic compared to domestic, further underscoring the disconnect between policy and reality..
More than 100 days into the administration of Masoud Pezeshkian, the government has strengthened its position on tiered internet access and the foundations of “cyberspace governance,” despite Pezeshkian’s promises regarding ending filtering. Indeed, comments by administration officials indicate they’re preparing to expand state control of the internet network on the pretext of malware risks regarding circumvention tools as well as a lack of financial transparency around such tools.
The regional crisis and military exchanges between the Islamic Republic and Israel have driven internet consumption as users have sought to follow events online. In the wake of this, we observed a service disruption stemming from a lack of broadband to meet demand. This was contrary to October 7 claims by Minister of Communications Sattar Hashemi that Iran’s internet disruptions were due to increased content production. Regardless of the volume of content produced, it is the number of views that drive traffic increases. If bandwidth does not expand to keep up with consumption, the network will suffer outages and slowdowns.
Consequences of the Iran-Israel Conflict for Iranian Users
On October 1, Iran’s banking network and a portion of its IPs were moved to “Iran Access,” a system which allows access only from the internal national network. Banks and internet providers were not informed beforehand. Though officials denied a red alert notice from the Center for Content Production and Information Exchange Security, sources told Filterwatchthat that Center announced such a status from September 29 and counter-DDoS attack systems had been activated accordingly. The “Iran Access” switch was made the same day, and that status remains.
The transition of networks to Iran Access is a means of heading off expanding cyberattacks. On October 20, around two weeks after the bank network was moved to Iran Access, Infrastructure Communications chief Behzad Akbari spoke of widespread DDoS cyberattacks in a short video. Those attacks, performed by bots, had been repelled, he said.
Iran Access makes it impossible for users outside the country to connect to VPNs capable of accessing Iranian sites within it. The disruptions were instituted to separate domestic and external traffic for electronic payment programs and banks. According to information received by Filterwatch, the Iran Access order came from sources higher than banks and electronic payment services companies. No time frame for a reversal has been announced.
One tactic employed by the Islamic Republic for countering protesters is to raise the possibility of military crisis or regional conflict. Iran Access’s activation of the country’s internet for purposes of preventing DDoS attacks is in line with this. This measure blocks access for Iranians outside the country to many ordinary services, and also disrupts service for Iranian citizens inside the country by shutting off communications with international service providers.
Furthermore, the failure of bandwidth to keep up with sudden user demand at sensitive moments – driven by spiking interest in news and social media – results in severe disruptions to users’ internet access. This trend was notable in the past month. Electrical outages and human error also affect conditions. During security crises and moments of increased risk of military attack, moreover, GPS disruptions increase, allegedly to influence location-finding capabilities of drones. Because of their effect on satellite timekeeping systems, these disruptions also impact internet service.
Two VPN providers told Filterwatch they saw a sudden spike in traffic during Iran’s missile strike on Israel on October 1, owing to an increase in social media and news browsing.
On the October 7 anniversary of Hamas’ attack on Israel, Version 6 Protocol suffered severe disturbances throughout Iran, resulting in major disruptions to filter-breaker access in the country.
Filtering and Governance
One of Masoud Pezeshkian’s campaign promises was to end filtering, which some claim remains a goal of his administration. Though the administration has presented no precise plan after two months in power, a spokesman called on citizens to be patient, while the Minister of Communications spoke of consensus and a suggestion box as alternatives to filtering.
Economic Minister Abdolnasser Hemmati, meanwhile, highlighted the need to develop plans for filtering and a cell phone registry. Despite this, given the imperative to implement cyberspace policy in line with the views of the Supreme Leader and the Supreme Cyberspace Council (which operates under his supervision), there appears a greater likelihood that new restrictions will take the form of tiered internet access (in which citizens have differential access based on their social position through government-approved VPNs), rather than a total end to filtering. By these means, the internet is offered to users in a “governed” fashion (in the words of Majles representative Ahmad Fatemi), and the goals of filtering are met.
The government seeks to compel people to use the internet in the ways it approves through designing policies, granting official status to domestic platforms, and neglecting and controlling access to foreign platforms. One example of this is the draft version of a measure regarding cyberspace advertisements, tabled on October 15, which officially recognizes only platforms based inside Iran.
Without a definite, comprehensive plan to end filtering, it appears that Pezeshkian’s administration is not aware of the chaotic state of Iran’s internet, or is at least negligent of its previous claims. Moreover, it seems to view circumvention tools more as a matter to be investigated (owing to a lack of transparency in their sale) rather than in terms of citizens’ right to access.
In his administration’s first meeting of the Supreme Cyberspace Council on October 1, Pezeshkian emphasized “countering purchases” of circumvention tools and “reporting on the present state of the internet.” He made the comment despite the fact that in the past year alone, three comprehensive reports detailing Iran’s internet, disruptions to it, and the structures that encompass it, as well as possible solutions, have been published by the Electronic Commerce Association of Iran. These reports made use of both domestic and foreign sources.
Despite all the restrictions on internet access for Iranian users that result from government policy and efforts to deny official recognition to foreign platforms, polls show that users have been able to overcome limitations and use filtered platforms, even despite the relative expense of foreign traffic and disruptions to circumvention tools. The newest polling from the Center for Polling Iranians (ISPA), published October 8, shows that YouTube is the fourth most-used site among Iranian university students, used by more than 50 percent of students at public universities. Telegram, WhatsApp, and Instagram – all previously filtered – are also widely used among Iranians.
Jump in Government Camera Surveillance
One tactic the government has relied on to control citizens (especially voluntary hijab proponents) since late summer 2022 has been the use of closed-circuit and municipal cameras. Claims have circulated that authorities have used municipal cameras to identify citizens through face-recognition systems, that universities have deployed such systems under the guise of automated self-service technology, and that Iranian police have used the “Nazer” app (along with the help of trusted collaborators) to identify mandatory hijab opponents.
In line with this trend, Iran’s Guild Room announced on October 1 that all guilds would be required to install cameras in their places of business following standards set out by the Law Enforcement Command. The cameras must be online and connected to police surveillance systems through a system called “Septam.” Septam divides businesses into five categories based on security considerations, with the two most sensitive subject to 24-hour observation by police, an arrangement called “smart guardian.” Though the particularities of the companies which formed Septam aren’t known, Filterwatch investigations show that the software firm Datis, at least, collaborates with it. Datis previously worked with the Prosecutor General on facial recognition technology and repression systems.
As Septam was unveiled around early October, a conference entitled “Space and Demand for Smart Technology” saw two companies sign letters of understanding with the Law Enforcement Command regarding smart policing services. One of the projects had to do with identity verification.
Domestic Mobile Phones: Economy and Hardware of the Internet Market in Government Hands
The Islamic Republic’s overarching policy of “governing the course of the internet” in its hardware dimension is to create appropriate space and infrastructure capable of providing its own customizable systems, as well as to control the market in economic terms. This policy, alongside the effort to produce and provide “sanctions breakers” instead of filter breakers, has meant that, in recent months, special credit facilities have been implemented to import and assemble mobile phone components under the name of “domestic mobile phones.” This effort has been part of an overall plan to develop a national network which specifies 20 percent of the market to be filled by domestic production by March 2026. Customs figures from March to August indicate an increase in mobile phone components named SKD and CKD, which are ultimately used to manufacture customizable domestic mobile phones.
