Authors: Miaan Group, ASL19, IODA
Contributors: Kentik, Cloudflare, OONI, Tor, Lantern, eQualitie, Psiphon
Executive Summary
The June 2025 Internet shutdown in Iran, carried out during the war with Israel, marked a significant and strategically distinct moment in digital repression. This operation, which we term the “stealth blackout,” differed sharply from earlier shutdowns that relied on simple, brute-force disconnections. Instead, it was a carefully planned, phased effort to sever the Iranian population’s connection to the global Internet while maintaining the illusion of normal connectivity for outside observers. This approach highlights a calculated evolution in the Islamic Republic’s efforts to control information and consolidate a state-controlled digital ecosystem through the National Information Network (NIN).
The Stealth Blackout: Technical and Strategic Evolution
The June 2025 operation differed sharply, both technically and strategically, from previous shutdowns. In 2019, the Iranian government cut the country off from the global Internet by simply taking down Border Gateway Protocol (BGP) routes. This method was highly visible and served as a clear indicator of an imminent total blackout, though it took over 24 hours to be implemented nationwide because each provider implemented it separately. The 2019 method was crude and inflicted enormous collateral damage.
In contrast, the June 2025 shutdown did not involve severing BGP routes, which allowed the country to retain an outward appearance of normal connectivity for traditional monitoring tools. Instead, authorities employed a more sophisticated and centralized system at the national border. This approach combined several advanced methods, including DNS poisoning to redirect or block requests for foreign websites, protocol whitelisting to allow only pre-approved domestic services, and Deep Packet Inspection (DPI) to aggressively filter and block traffic from specific tools. Together, these layers of control neutralized many circumvention tools without fully halting domestic services. As a result, during this shutdown, Iran’s traffic and connectivity to the global Internet plummeted by about 90%.
While the 2019 and 2025 shutdowns involved both cellular and fixed-line networks, the 2022 shutdown during civil protests utilized different tactics. In 2022, authorities imposed a nightly curfew on cellular operators, affecting the same networks as 2019. However, the duration of the disruptions in 2022 and 2025 were similar, each lasting for nearly two weeks, while the 2019 shutdown lasted six days. The 2025 shutdown’s wartime context was also unique, with the government justifying the restrictions as a means of deterring cyberattacks from Israel.
The Resilient Response: Tools and Community Adaptation:
The June 2025 shutdown had a significant impact on circumvention tools, revealing a new level of sophistication in government interference. Data shows that even when users could connect, their data traffic was often throttled, which in many cases rendered these tools functionally useless for anything more than basic text communication.
Nevertheless, the Internet freedom community reacted quickly, sharing information and deploying technologies that succeeded in keeping millions of Iranians online. They accessed international internet and foreign-hosted content with a greater variety of VPNs and peer-to-peer solutions than in the prior 2019 near-total shutdown. The community relied in part on lessons learned from past shutdowns and closer coordination. The overall success demonstrated that utilizing different technologies, methodologies, and networks increases the possibility of sustained connection even during the most severe internet shutdowns.
Individual tool performance offered critical data on adaptation:
- Psiphon’s multi-protocol design was crucial in maintaining access for 1.5 million users at the height of the shutdown, roughly one third of its normal user base.
- Lantern saw moderate success with its proxyless protocol, which accounts for about 40% of its traffic.
- BeePass VPN contributed to censorship tactic research by experimenting with different VPN access key configurations (different combination of network ports and traffic obfuscation prefixes) to investigate the parameters’ relevance to the intense blocking. BeePass was providing access to over half a million daily users inside Iran at the start of the war.
- The Ceno Browser, with its decentralized, peer-to-peer network, saw a significant increase in active peers, from 600 on June 13 to nearly 8,000 by July 11. Notably, even during the blackout, some Ceno connections remained online.
- Tor usage quickly rebounded after the shutdown was lifted, with bridge connections surging during the blackout, indicating users’ rapid adaptation.
The goal of this report is not to offer a direct comparison of individual circumvention tool performances. Instead, we explore the evolving tactics of digital repression wielded by the Iranian government, demonstrate the impact of the shutdown on Iranian users, and document the response of the international tool developer community in supporting access solutions for Iranians. Ultimately, the successful outcome—where more Iranians found their way online during this shutdown than the 2019 near-total blackout—underscores a crucial conclusion: a wider variety of tools and tactics will succeed at different times and against different censorship methods, reinforcing the necessity of a diverse and resilient internet freedom ecosystem.
Human Rights Implications
The shutdown’s human rights implications were profound and directly linked to a surge in physical persecution. The government exploited the wartime atmosphere to create communication barriers that endangered lives by blocking access to essential services like Google Maps, which led to people getting lost while trying to flee to safety. The government also blocked international One-Time Passwords (OTPs), crippling new sign-ins to secure communication platforms and VPNs. This forced many citizens onto government-approved domestic platforms that have security and privacy vulnerabilities. This deliberate silencing of communication channels suppressed documentation and reporting of human rights abuses, fueled fear, and disproportionately affected journalists, ethnic minority groups, and human rights defenders.
Key Takeaways and Policy Blueprint
The June 2025 Internet shutdown serves as a crucial case study in the evolution of digital authoritarianism. The Iranian government’s ability to orchestrate a rapid, centralized, and covert blackout provides a dangerous blueprint that other authoritarian states may seek to emulate. The contrast to the blunt methods of the 2019 shutdown highlights the necessity of sustained investment in resilient circumvention tools, not only to stand up for freedom of expression and access to information, but as a key component of foreign policy. This development underscores the urgent need for coordinated international policy and technological responses to counter these threats and safeguard digital rights.