More than two weeks after Iranian users were systematically severed from the global internet, technical data and field reports indicate the digital crisis has entered a volatile new phase. Since March 13, 2026, the regime’s restrictive architecture has expanded beyond general blocking to target even the "white SIM cards"—the privileged connections previously reserved for state-aligned entities. These disruptions have now bled into the National Information Network (NIN) itself, destabilizing government platforms, critical infrastructure, and the domestic banking system.
For a population already enduring the physical reality of bombardment, the systematic dismantling of communication has made daily survival increasingly precarious. This inward collapse of even domestic services has intensified fears that Iran is moving toward a total and indefinite internet blackout, mirroring the near-total digital isolation witnessed in January 2026.
Revoking “White SIM Card” Access
The strategy of tiered internet access appears to be fracturing. Reports from within Iran indicate that on March 13, the Secretary of the Supreme Council of Cyberspace, Seyyed Mohammad Amin Aghamiri, ordered new restrictions on "white SIM cards" specifically used by the Ministry of Oil. These cards were originally designated for employees requiring elevated access for critical oil-related transactions. However, this shift is not isolated to the energy sector; additional reports suggest that a much broader group of users who previously held these privileged credentials have also seen their access revoked.
This reversal stands in stark contrast to recent government rhetoric. As recently as March 9, government spokesperson Fatemeh Mohajerani stated that measures were being taken to ensure those who "convey our voice to others" would maintain communication facilities. Yet, only days later, many of these state-sanctioned messengers—including prominent business figures, artists, athletes, and media personalities—found themselves cut off from the global internet. The sudden loss of access for those expected to serve as the government’s digital outreach suggests a deepening of the domestic isolation strategy.
Simultaneously, the Tehran Chamber of Commerce has re-implemented a controlled system of tiered access for economic actors, mirroring the emergency arrangements from the January blackout. Under this regime, commercial card holders may apply for international connectivity, provided they undergo rigorous identity verification and device-based IP registration. While this offers a narrow window of global access for trade, the highly regulated nature of the system underscores a broader trend: the state is no longer just filtering content, but is now micro-managing individual connectivity as a scarce and conditional resource.
Disruptions in the National Information Network: From Messaging Apps to Domestic Platforms
Contrary to the government's narrative of a self-sufficient internal network, major domestic messaging applications have faced cascading outages. On the evening of March 14, the platform Bale became entirely inaccessible for a significant portion of its user base. Simultaneously, the messaging service Eitaa issued an urgent notice that storage limitations would force the deletion of any user files larger than 50 MB, signaling a severe strain on domestic server capacity. By March 15, reports confirmed that Rubika, one of the most widely used domestic platforms for communication and content, had also fallen offline.
Beginning on March 13, the National Information Network (NIN)—the state’s domestic alternative to the global web—began showing signs of systemic instability. Contrary to the government's narrative of a self-sufficient internal network, major domestic messaging applications have faced cascading outages. On the evening of March 14, the platform Bale became entirely inaccessible for a significant portion of its user base. Simultaneously, the messaging service Eitaa issued an urgent notice that storage limitations would force the deletion of any user files larger than 50 MB, signaling a potential strain on domestic server capacity. By March 15, reports confirmed that Rubika, one of the most widely used domestic platforms for communication and content, had also fallen offline.
These disruptions have bled into the broader digital economy and state media apparatus. Vital services, including the ride-hailing platform Snapp and state-run news agencies such as ISNA and IRNA, have reported intermittent but persistent outages. This volatility extends to the very foundations of internal connectivity; home internet connections, domestic servers, and locally hosted websites have all experienced significant downtime. Furthermore, the few remaining functional VPN services that managed to bypass earlier restrictions were reported as largely inaccessible by the evening of March 14.
Individual accounts from within Tehran highlight how these technical failures are impacting essential civil functions on a granular level. One resident informed Filterwatch that after attempting to report a suspicious vehicle, law enforcement officers stated they were unable to perform a routine license plate check because their internal systems were offline. Similarly, while official media outlets claimed municipal e-service offices remained operational, a citizen attempting a passport renewal was told in person that the necessary digital infrastructure was unavailable. These reports, while anecdotal, suggest that the instability of the national network is beginning to interfere with the basic administrative capabilities of the state.
Disruptions in Communications Infrastructure: Reports of Data Center Shutdowns
At the foundational level, reports from within the country suggest that the domestic data center ecosystem is experiencing significant friction. There are growing indications of a lack of coordination between key infrastructure players, most notably with reports that the Mobile Communications Company of Iran (MCI) has severed connectivity to specific nodes operated by the Telecommunication Infrastructure Company (TIC). Furthermore, unverified reports have circulated claiming that several key data centers—including facilities at Payam Airport in Karaj and those associated with ArvanCloud—have been “shut down” entirely.
These structural disruptions are being mirrored by a series of unusual directives issued to the country's tech sector. Professionals across the industry—including system administrators at major ISPs and hosting services—report that the TIC has issued urgent instructions to perform immediate data backup procedures. These alerts have appeared both through administrative panels and direct communications to network nodes.
Within the Iranian tech sector, there are two primary interpretations of these developments. Some experts believe these measures are defensive, aimed at insulating the NIN from potential cyberattacks that could exploit internal infrastructure. However, others view this widespread instruction to backup data and isolate data centers as a more ominous signal: the potential implementation of a broader, more permanent network shutdown. Whether these actions are a protective posture or a preparation for total severance, they represent a significant escalation in the state's efforts to control the physical and digital boundaries of the network.
Technical Analysis: Tracking the Erosion of Residual Traffic
Technical data confirms that the already severely limited internet traffic in Iran underwent a significant new contraction starting on March 14. According to analysis by Doug Madory, Director of Internet Analysis at Kentik, a new large-scale disruption was detected at 12:00 UTC (15:30 local time) on March 15. While the country has been in a "near-total" blackout since late February, these new data points illustrate a systematic narrowing of the few remaining gateways used for global communication.
The Kentik visuals below highlight a precipitous collapse in this remaining whitelisted traffic, particularly within the network of the Mobile Communications Company of Iran (MCI, AS197207). Following the 12:00 UTC mark on March 15, outbound traffic for MCI fell sharply and stabilized at a near-dormant level, effectively flatlining for the remainder of the observation period. While not represented in a standalone graph in this specific update, field data and internal reports indicate that the Respina Network (AS42337)—an infrastructure often used by business and enterprise clients—experienced a similar collapse in traffic flow.
The same pattern is visible in the country’s aggregate traffic data, suggesting that the already limited pathways for connecting to the global internet have been further reduced.
The broader context provided by Kentik’s long-term charts below (spanning from January to mid-March) reveals a "stepped" approach to isolation. Following the first major shutdown in January and a subsequent "partial restoration" in February, the current "Shutdown #2"—which began on February 28—has been characterized by persistent, incremental drops. The data from March 2, March 5, and March 15 show a series of "cliffs" where residual traffic was further throttled. Each of these drops represents a narrowing of the "whitelist," suggesting that the state is not merely maintaining a blackout but is actively fine-tuning its architecture to eliminate any remaining bypasses to the global internet.
Disruptions in the Banking System: Online Banking Outages and Cash Shortages
The instability within the National Information Network has moved beyond communication tools to strike at the heart of Iran’s financial infrastructure. Beginning on March 9, banking services—notably Bank Melli and Bank Sepah—experienced major disruptions with their online systems remaining inaccessible for more than a week. While official domestic media attributed these outages to “hardware changes” and updates to the banking network, the news outlet Tabnak, citing Saberin News, suggested a more defensive motive: that Bank Melli preemptively shut down its servers to avoid a catastrophic cyberattack similar to one that had reportedly targeted Bank Sepah.
The collapse of digital banking has been compounded by a deepening cash crisis. In an apparent attempt to manage the fallout, the Central Bank of Iran announced on March 12 that the daily ATM withdrawal limit would be increased to 500,000 tomans. Officials framed this as a measure to "facilitate easier access" for citizens and align with the issuance of new Iran Cheques.
However, field reports from Tehran tell a very different story. Residents describe a scene of widespread frustration where many ATMs are either entirely out of service or have run out of banknotes. Even those who manage to find a functional machine after waiting in long lines report being able to withdraw only minimal amounts—typically between 500,000 and 1 million tomans. This combination of offline banking systems and a physical shortage of cash is placing an immense strain on the daily lives of citizens, who are forced to navigate a collapsing economy alongside the ongoing disruptions to their communications.
Civilians Caught Between War and a Communications Blackout
As the systematic dismantling of the internet continues, the Iranian public has been forced into a predatory black market to maintain even the most basic global connections. With standard VPNs largely neutralized, citizens are turning to expensive, specialized configurations that offer no guarantee of stability. Reports indicate that prices in this underground economy have soared, with a single gigabyte of data occasionally selling for as much as 1 million tomans. For the vast majority of the population, these costs are not only prohibitive but represent a form of economic warfare, where the right to communicate is reserved for those who can afford it.
The financial burden extends beyond data to the very cost of a voice call. Rising prices for international roaming packages have created a massive barrier for those attempting to reach family abroad. For instance, packages offered by MCI now range from approximately 1.8 million tomans for an hour of talk time to 4 million tomans for a three-hour limit. In a country grappling with the physical and psychological pressures of ongoing bombardment, these are not luxury expenses; they are the literal price of safety.
Under the current conditions of war, reliable communication is a critical humanitarian tool. Families depend on these networks to confirm the safety of loved ones, coordinate evacuations, find shelter, and receive emergency alerts. By systematically disrupting these pathways and allowing a black market to flourish, the state has rendered this essential tool either financially inaccessible or functionally unavailable. In doing so, it has left millions of civilians digitally stranded at the very moment their survival depends on being heard.