Following the nationwide protests that began on December 28, Iran’s internet underwent a dramatic transformation. What started as regional and targeted disruptions shifted into a near-total nationwide blackout on January 8 with even the National Information Network (NIN) largely inaccessible, severing access to everything from banking to government services.
While connectivity began a phased restoration on January 17, it has not returned to a normal state. Technical data and official statements confirm that the state has shifted to a “white-listed” model—a system where the global internet is blocked by default, and only specifically authorized services are permitted to function.
The State of the Whitelist:
Currently, access is non-uniform across the country and varies by provider. However, a specific set of international platforms and services have been "whitelisted" to allow for a baseline of digital functionality:
- Search Engines: Google, Bing
- Communication Tools: Google Meet, Gmail, Outlook
- App Stores & Tech Sites: Play Store, App Store, Apple, and Samsung website
- Developer & AI Tools: ChatGPT and GitHub
- Gaming: PlayStation
- Navigation: Google Maps
Regarding social media and messaging platforms, Instagram, Telegram, YouTube, and X remain accessible only through circumvention tools and continue to suffer from instability. Similarly, the status of WhatsApp and LinkedIn—which were previously accessible—has deteriorated to the point that they now effectively face the same restrictive conditions as the aforementioned platforms. The only notable shift in recent days occurred on January 27; user reports indicate that a higher number of VPNs are now functional compared to the initial days of the internet shutdown, when most circumvention tools were rendered useless. This improved connectivity for certain VPNs suggests a potential expansion of selective access (aka whitelisting) within the network.
The Economic Catalyst for Whitelisting
The shift toward a whitelist is also partly a survival strategy for a collapsing economy. On January 26, ICT Minister Sattar Hashemi, revealed that the total blackout cost the national economy approximately 5 trillion Tomans daily.
Over the 18-day blackout, total losses reached an estimated 90 trillion Tomans. With 10 million livelihoods tied to the digital economy and an "economic resilience threshold" of only 20 days for online businesses, the government could no longer afford a total shutdown. The whitelist acts as a compromise: it restores the "Digital Economy Core" while keeping the "Social Media Core" under strict, protocol-based control.
Evidence of A Discriminatory System: Zoomit and Shargh Daily
A detailed field report by Zoomit provides a rare, firsthand look at how this whitelisted policy is being piloted through a "tiered internet" framework at the Tehran Chamber of Commerce. The report describes an environment where digital access is treated as a highly regulated security clearance rather than a business tool. Since January 15, international connectivity has been transformed into a monitored privilege.
Identity-Linked Access: To gain even a temporary window of connectivity, merchants must physically present their business cards and register the specific IP addresses of their devices. This creates a permanent digital trail, linking every professional action directly to a verified identity under state surveillance.
In a move that formalizes the end of digital privacy, users are reportedly forced to sign a written commitment vowing "not to misuse this privilege." This vague terminology serves as a psychological deterrent, leaving users vulnerable to state retaliation for any activity deemed "unauthorized."
The Stratification of Space: Strikingly, this "unfiltered" access is not a blanket signal. It is strictly confined to designated zones within the building. Users cannot walk to their own offices or common areas without losing the connection, effectively creating a system of digital stratification where your physical location determines your level of access to the global world.
This institutionalized discrimination is being closely tracked by other domestic outlets. Shargh Daily has been at the forefront of documenting the rise of what it calls the "class-based internet." Their reporting highlights how a policy initially framed as a "temporary support measure" for essential sectors—such as journalists and university faculty—has quietly morphed into a permanent framework for national governance.
The Roots of the Whitelist in the "Protection Plan"
This pattern of selective access is not a temporary reaction, but the realization of a long-term legal framework. The "Cyberspace Regulatory System"—the latest iteration of the controversial User Protection Bill—was officially submitted to Parliament again on November 19, 2025. Initially introduced in 2018 as the "Social Messenger Regulation Plan" and then again in February 2022 as the "Cyberspace Services Regulatory Plan," its ratification was repeatedly delayed due to widespread opposition from civil society and digital rights activists.
Under this plan, high-level policymaking and the determination of access protocols at the "International Internet Gateway" are explicitly placed under the authority of the Supreme National Security Council (SNSC). The Council’s directives are legally binding for all executive bodies. Consequently, the power to disconnect, restrict, or restore internet access is now embedded within a formal, pre-defined mechanism that delegates the management of international communication flows to security apparatuses.
The plan prioritizes the development of the NIN, mandating all executive agencies provide their digital services exclusively through this domestic platform. In this model, the domestic network is defined as the default, stable state, while access to the international internet is treated as a conditional, restricted, and manageable exception. This framework perfectly aligns with the current reality: domestic services remain functional while foreign services are restored only gradually and selectively.
Furthermore, this bill criminalizes the production, distribution, or use of VPNs, and the Ministry of Communications is tasked with the continuous identification and neutralization of these tools.
The Crackdown on Technical Transparency
This transition to a whitelisted model is being enforced through more than just code; it is being enforced through state pressure on the technical community. Recent reports regarding the arrest or summoning of internet and network security specialists in Iran indicate that the state's crackdown is not limited to policy making.
Even individuals providing technical transparency or analytical insights into the state of the network have faced pressure, threats, or prosecution. These developments demonstrate that the whitelisting of access and protocols is not a temporary fix, but rather a core component of a digital governance model designed to eliminate any oversight of how the state manages the digital realm.
Recent Changes in Iran’s Internet Connectivity: A Technical Perspective
Technical data from Kentik and IODA confirms this is a "low-volume" restoration. Traffic remains at only 25% of pre-shutdown levels, further proving that the vast majority of the global internet remains inaccessible to the general public. More technical details are shared below:
According to data from the IODA project, a significant increase in the Active Probing index for Iranian networks has been observed since the early hours of January 27.
Active Probing is one of IODA’s primary signals for measuring global internet connectivity. It works by sending requests (pings) to devices and networks within a country and measuring the responses. A successful response to these probes indicates that the local network is communicating with the international internet.
IODA charts show that after a prolonged period of "silence"—where Iranian networks failed to respond to active probes, consistent with a total blackout or severe restriction—responses began to re-emerge on January 27. This shift signals a relative and gradual restoration of global internet connectivity.
Data from Kentik, a leading network monitoring company, further confirms this gradual return of traffic. Doug Madory, Director of Internet Analysis at Kentik, confirmed on January 26 via X that a notable surge in inbound traffic to Iran has been detected in recent hours. However, he emphasized that traffic levels remain significantly lower than they were prior to January 8, staying far below normal parameters.
As of January 27, Kentik’s data suggests that while the shutdown remains in effect, a limited but steady recovery of traffic is underway. This trend aligns with the implementation of the "whitelisting" system designed to manage and control access. According to Madory, current traffic volume is estimated to be only about 25% of pre-shutdown levels.
The Rise of the “Melli-Shekan”
Based on statements from the Supreme National Security Council, technical observations, and the pattern of limited restoration, it appears that Iran's internet will remain accessible only through a selective, whitelist-based model for the foreseeable future. This is not a return to the status quo, but the dawn of a "block-by-default" world.
As this new reality sinks in, the Iranian lexicon is shifting. Users are no longer just looking for a Filter-shekan (VPN); they are now seeking a "Melli-shekan"—a "national-network-breaker"—to escape the confines of a whitelisted digital prison.
Many advanced users are attempting to find workarounds by setting up proxies via whitelisted IP ranges to tunnel international traffic into the country. However, this whitelisted model makes bypassing censorship significantly harder for the average user. These methods require advanced technical knowledge, complex configurations, and specialized tools that are out of reach for the general public. By transforming the internet from an open network into a gated environment, the state has shifted the default status of global connectivity from a public right to a conditional privilege. This transition effectively ensures that for millions of Iranians, the internet is no longer a shared utility, but a vanishing horizon.