More than two weeks into the internet shutdown in Iran, statements by the Secretary of the Supreme National Security Council have confirmed that restoring internet access is not currently on the agenda of security institutions. As in previous instances, the Council has cited security concerns to avoid providing a clear timeline for reconnection. . Instead, officials have adopted terms such as “localized” and “issue-based” restoration—language that signals the activation of a whitelisting strategy, granting selective access only to individuals or organizations vetted and approved by the authorities.
Although reports began circulating after midnight on January 17 indicating that some users had regained internet connectivity, and technical data shows a slight uptick in network traffic, these connections remain highly limited and do not indicate a broad return to public access. The implementation of selective, restricted connectivity—a tactic the Iranian government has repeatedly employed in the past—follows a pattern similar to internet control models observed in countries such as Russia.
As Alan Woodward, Professor of Computer Security at the University of Surrey, told BBC Persian: “It appears that a process is underway in Iran to deprive everyone of any form of electronic access unless it has been authorized and approved by the government.”
1. Internet Network Conditions in Iran (January 14–21)
1.1 Government Focus on the National Information Network (NIN)
Between January 14 and January 16, access to the international internet, inbound international calls, and SMS services remained completely cut off. This applied both within Iran and to roaming services from outside the country into Iran. During this period, the government’s strategy was clearly centered on internalizing communications traffic and forcing reliance on the National Information Network (NIN).
Selective Restoration: Concurrently, authorities began a phased , selective restoration of access, particularly across domestic messaging platforms. Initial access was restored first for verified channels and accounts, well-known individuals, and subsequently for users whose identities had been authenticated. This pattern suggests that the “Trusted Identity System for the National Cyberspace” - long-standing government plan - has likely entered an operational phase. Under this model, future access to international platforms may be restricted to designated VPNs subject to strict user identification, effectively transforming the internet from a public utility into a personalized, traceable environment.
Iran.ir Portal: On January 15 domestic media encouraged users to visit iran.ir to access available services and websites. Presented as a centralized directory of "approved" websites, this portal effectively serves as the official reference for a state-sanctioned intranet, directing users only to resources the authorities have chosen to keep accessible.
1.2 The Beginning of Changes in Access Levels (Since January 16)
Restoration of SMS Services
On January 16, domestic and roaming SMS sending and receiving services were restored. This marked the first step in a tiered restoration plan previously announced by state-affiliated media, such as Fars News Agency, which outlined a sequence of return: first SMS, then domestic platforms, and finally, international access.
Fluctuating Traffic Patterns
From January 16 onward, network data from IODA and Kentik displayed a stop–start pattern. The volume of restored traffic amounted to only 0.2% of Iran’s normal, pre-shutdown traffic levels.
Traffic would briefly spike before being suppressed again - a behavior experts attribute to the testing and fine-tuning of a classified filtering system. This aligns with statements from the Secretary of the Supreme National Security Council’s statements regarding “localized” access as well as Delirian, the spokesperson for the National Cyberspace Center. In a live television interview, he confirmed that special access arrangements had been defined for sectors such as international trade under the supervision of chambers of commerce—statements that substantiate an institutional and selective access model, even if such a framework is officially denied.
Access to Google Services
By the afternoon of January 17, Google Search became accessible on some operators’ networks. Access was first restored on mobile networks—specifically MCI, Irancell, and Rightel—and was gradually extended to fixed-line internet users. However, critical services such as Gmail and Google Meet remain blocked or their traffic is still not passing.
Media and Businesses Connectivity
- International internet access was gradually restored for newsrooms starting January 16.By January 19, field reports from inside Iran indicated that internet access had become available in the newsrooms of most newspapers. Similarly, starting on January 16, various online businesses—from e-commerce platforms like Banimode to super-apps like Snapp—resumed sending SMS notifications, indicating their services were back online.
Public Access to the International Internet
Beyond the whitelisted tiers, , ordinary users gradually began to establish short-lived and unstable connections to the international internet starting January 16. These connections were typically achieved through complex technical methods such as DNSTT, specialized V2Ray configurations with SNI manipulation (including the use of whitelisted domains), or Google-based domain fronting.
The Black Market for Access
According to reports from domestic media, access to the international internet has increasingly become a scarce and costly commodity. Limited VPN and proxy configurations—sometimes offering only a few megabytes of data—are being traded, while some configurations connected to specific routes or data centers have reportedly sold for tens of millions of tomans. At the same time, foreign SIM cards—particularly Iraqi SIM cards—have become highly valuable assets, with prices in some cities reported to reach up to 30 million tomans.
This situation has forced some citizens to incur substantial travel costs to border regions in order to obtain short-term internet access. Alongside the expansion of this black market, users have also raised concerns about the status of purchased internet data packages. During the international internet shutdown, uncertainty around how limited domestic traffic is calculated and priced—and the potential for under-delivery—has emerged as another consequence of the policy of cutting and selectively restoring internet access.
1.3 Heightened Security Tensions, Information Suppression, and Efforts to Control Narratives
On the evening of January 18 (approximately 9:30 p.m. Tehran time), the state broadcaster (IRIB) suffered a significant breach. For approximately ten minutes, satellite signals (particularly those transmitted via the Badr satellite) were hijacked to broadcast protest footage and anti-government messages. The hacktivist group Anonymous claimed responsibility for the incident, describing it as part of Operation OpIran.
- On January 19, Meta announced enhanced security protocols for Instagram and Facebook users in Iran. According to Meta, these measures were implemented after observing patterns of arrests, violence, cyberattacks, and coordinated attempts to gain unauthorized access to user accounts—particularly those belonging to activists and journalists. Given the serious security risks facing Iranian users, Meta introduced policies to prevent account compromise and security abuse. Citing patterns of arrests and coordinated attempts to compromise the accounts of activists and journalists, Meta introduced measures to restrict the visibility of "follower" and "following" lists to prevent security forces from mapping users' social networks.
2. Continued Government Efforts to Disrupt Alternative Communication Pathways
As noted in our previous report, the government continues to target alternative communication channels—such as Starlink.
Starlink Jamming and Confiscation: Technical analyses and field reports indicate that jamming of Starlink terminals is ongoing, albeit with varying intensity. However, following software updates deployed by Starlink, some terminals have remained operational and have been able to circumvent these blocking attempts.
Reports from the cities of Sanandaj, Tehran, Isfahan, Mahabad, Bukan, and Marivan indicate the physical confiscation of satellite dishes by security forces. At the same time, the Tasnim News Agency has officially denied these reports and warned citizens that individuals posing as security personnel may be attempting extortion. This media denial stands in clear contradiction to on-the-ground evidence and coincides with ongoing technical disruptions.
Official Complaint to the ITU: At the international level, on January 13, Iran’s ambassador to the United Nations Office at Geneva (UNOG) sent an official letter to the Secretary-General of the International Telecommunication Union (ITU), describing the operation of Starlink terminals in Iran as “illegal and unauthorized.”
Notably, the letter also claims that “internet connectivity across the country remained available throughout the protests.” This assertion relies on a distorted definition of the internet, one in which limited access to the National Information Network and whitelisted services is treated as equivalent to full internet connectivity.
By redefining “the internet” in this manner, the letter seeks to deny the existence of a nationwide shutdown of the global internet and to portray the nationalization of communications as a proportionate security measure—claims that stand in direct contradiction to independent network measurement data.
Free Starlink Access: Despite the government’s sustained efforts to eliminate Starlink access, digital access advocates—following weeks of negotiations and coordination with the Starlink team—succeeded on January 14 in enabling free Starlink subscriptions for users inside Iran, subscriptions that would otherwise cost at least 50 USD per month. This development further underscores the widening gap between the government’s official policies and civil society efforts to preserve independent communication pathways.
Taken together, technical data, field evidence, and official statements indicate that the internet shutdown has not ended; rather, it has entered a stabilized phase of a deliberately engineered national intranet. Despite assurances from some officials—including the Vice President for Science and Technology—regarding an "imminent return to normal," the reality on the ground is different. Remarks by Ali-Akbar Pourjamshidian, Secretary of the Supreme National Security Council, in a televised interview on January 21, confirm that Iran’s internet remains effectively trapped in a communications black hole.