On May 26, 2026, after 88 days of severe restrictions on international internet access, network monitoring platforms recorded the first signs of connectivity returning to Iran. Yet the apparent restoration did not amount to a full return to the global internet. Instead, the recovery was gradual, uneven, and accompanied by significant political controversy. This report examines both the technical evidence and policy developments surrounding the reopening process, arguing that Iran may be implementing a new hybrid model of internet control that combines visible connectivity with continued restrictions on meaningful access.
Key Findings
- Actual Traffic Recovery: On May 26, Iran recorded the first signs of network recovery following an 88-day near-total disruption of international internet access.
While some network monitoring services suggested a strong recovery, reporting that network capacity had returned to 86% of pre-disruption levels, more detailed technical analysis tells a different story. Data from Kentik indicates that actual international internet traffic had recovered to only about 60% of its pre–January 8, 2026 level by May 28.
- Hybrid Internet Shutdown Model: The restoration observed during this period does not represent a full reconnection to the global internet. Evidence suggests that Iranian authorities are implementing a carefully managed hybrid shutdown model. By reopening international gateways and traffic exchange points, they generate enough visible activity to signal recovery to automated global monitoring systems and support claims of normalization. At the same time, available data indicates that bandwidth remains heavily constrained behind the scenes, keeping actual volumes of international traffic significantly suppressed. This approach allows authorities to project an image of restored connectivity while maintaining substantial control over cross-border internet access.
- Technical Dissection of the Reconnection: This section examines the technical dimensions of Iran's internet restoration and therefore includes more specialized networking terminology. Technical terms and concepts have been translated and explained in a way that seeks to preserve their original meaning while remaining accessible to both specialist and general readers.
1) Gateway Expansion vs. Traffic Suppression: The Iranian government has, in practice, reopened international data traffic gateways and modified routing tables. However, while the number of devices connected to the network has increased dramatically, the amount of traffic per device has fallen to its lowest level on record. Users are technically connected to the network, but lack the ability to exchange data in a meaningful and effective manner.
2) Throttling and Censorship Mechanisms: This communications bottleneck is not the result of conventional website or IP-address blocking. Rather, it stems from deliberate manipulation of network infrastructure. Network measurements indicate the introduction of artificial and systematic latency, severe restrictions on UDP traffic, highly unstable TCP connections, and widespread DNS tampering, all of which appear designed to disable secure and modern internet protocols.
3) The Privileged Access Layer (White SIM Cards and Internet Pro): The apparent increase in data traffic is highly uneven and increasingly shaped by a tiered access model. While ordinary citizens continue to face severe digital restrictions, approved users equipped with so-called “White SIM cards” and the government's “Internet Pro” service are able to bypass the national firewall and access international websites with little or no disruption.
- Political Contestation: The restoration process underscored that decision-making over internet access in Iran remains contested among competing state institutions. While a newly established special committee voted to restore internet access, the Administrative Court of Justice sought to suspend the committee's authority, legal commentators on state television questioned the legality of its decisions, and government officials publicly defended the policy against growing criticism. Meanwhile, Internet Pro—a service that had been promoted for months as an alternative form of internet access—appears to have quietly remained in place. Having already been tested in practice, it is likely to remain available as an alternative model for future periods of internet disruption.
Policy Developments
From the Formation of a Special Committee to the Approval of Internet Restoration
On Tuesday, May 12, President and Supreme National Security Council Chair Masoud Pezeshkian established the “Special Committee for the Organization and Governance of Cyberspace,” appointing First Vice President Mohammad Reza Aref as its chair. The committee's first resolution called for restoring internet access to its pre-January conditions.
Following the establishment of the Special Committee for the Governance and Organization of Cyberspace, disagreements over the future of the internet in Iran became increasingly visible in public and media discourse. Whereas much of this debate had previously taken place behind closed doors through non-public meetings and decision-making processes, officials and figures affiliated with different state institutions have now begun openly defending competing visions for the country's internet policy.
In this context, on May 16, Rasoul Jalili, a member of the Supreme Council of Cyberspace, and Mohammad Hossein Saei, a member of the Supreme Council of the Cultural Revolution, outlined a relatively clear vision of their preferred model for Iran's internet future during a televised discussion.
In this vision, the internet is defined as a controlled and managed environment. Mandatory user identification, differentiated access levels for different segments of society, regulation of foreign platforms, and the development of domestic alternatives are presented as the core components of cyberspace governance.
The views expressed during the program may reinforce the argument that internet disruptions and the introduction of services such as Internet Pro are part of a longer-term strategy to redesign how users access the internet and exert greater control over the flow of information.
On May 18, during a ceremony marking World Telecommunication and Information Society Day, Minister of Communications Sattar Hashemi defended the creation of the Special Committee for the Governance and Organization of Cyberspace and praised the Ministry of Communications' performance during the war and the internet disruption. He claimed that approximately 500 communications sites had come under attack during the conflict, but that these attacks had not caused significant disruption to people's daily lives.
These remarks are noteworthy because Iranian authorities have repeatedly justified internet disruptions on the grounds of security concerns and cyber threats. Yet the minister's own comments indicate that cyberattacks against communications infrastructure continued throughout the nearly three months during which millions of Iranians were cut off from the global internet.
His remarks once again raise the question: if the internet disruption was intended to protect the country's infrastructure, how is it that hundreds of websites and communications systems continued to be targeted by cyberattacks despite these restrictions?
Thirteen days after the Special Committee's formation, on Monday, May 25, a meeting was held with 11 of the committee's 15 members in attendance. During the meeting, the proposal to restore internet access was approved by a vote of 9 in favor and 2 against.
According to Pazouki, the committee's communications officer, representatives from various military institutions also participated in the meeting. However, he did not provide further details regarding the specific military bodies represented.
The Beginning of Internet Restoration and the Start of Political Disputes
One day later, on Tuesday, May 26, the Minister of Communications announced that “following a directive from the President, and after three intensive expert-level sessions and the first formal meeting of the Special Committee, the process of restoring the country's internet access to its pre-January 2026 conditions has begun.”
Following the announcement of the internet restoration, around midday on May 26, Mizan News Agency, which is affiliated with the judiciary, reported that “following complaints regarding the resolution establishing the Special Committee for the Organization and Governance of Cyberspace, the Administrative Court of Justice has issued an interim order suspending the implementation of the resolution.”
Although the Administrative Court of Justice emphasized that the Special Committee's decisions and resolutions would not be enforceable until a final ruling on the complaints is issued, the restoration process had not been halted as of June 1, when this report was published. Moreover, government officials have repeatedly emphasized that the committee was established under the authority of the Supreme National Security Council, which holds greater authority than the Supreme Council of Cyberspace. As a result, the likelihood that the committee will be dissolved or stripped of its mandate appears low.
Later that same day, May 26, and only minutes after news of the legal challenge seeking to invalidate the Special Committee became public, Entekhab News reported that the four individual complainants behind the case were Kamyar Saqafi, Reza Taghipour, Rasoul Jalili, and Mohammad Hassan Entezari.
The outlet further argued that the complainants' political orientation was well known and claimed they had filed the complaint under the leadership of an official retained from the conservative Ebrahim Raisi administration.
From the Administrative Court's Clarification to Criticism on State Television
One day later, on May 27, Saeed Dolfani, a judge at the Administrative Court of Justice, wrote in Mizan News that the subject of the complaint before the court was neither public access to the internet nor policies restricting communications. Rather, he stated, the dispute concerned “the legal legitimacy of establishing an administrative committee and the scope of its authority.”
More specifically, the central question is whether the executive branch possessed the necessary legal basis and authority to create such a body.
Also on May 27, disagreements over the Special Committee's decision and the restoration of internet access reached Iran's state broadcaster. During a televised current affairs program, a legal expert argued that decisions issued by the country's established legal and supervisory bodies regarding internet policy could not simply be set aside. He further maintained that internet access could not be fully restored, even through a resolution of the Supreme National Security Council, unless authorized by a higher authority—namely, Iran's Supreme Leader.
Later that same day, however, Mohammad Jafar Ghaempanah, the President's Executive Deputy, explicitly defended the government's decision to restore international internet access by publishing the results of a nationwide public opinion survey. According to a source familiar with the matter who spoke to Filterwatch, the survey was conducted by ISPA.
The survey found that only 8.2% of respondents supported maintaining the existing level of internet restrictions, with overall support for restrictive internet policies estimated at less than 9%. By contrast, 51.2% favored restoring internet access to its pre–January 8 conditions, while 37.7% supported unrestricted internet access
The survey's other findings also painted a clear picture of widespread public dissatisfaction with internet restrictions. Seventy-eight percent of respondents described access to the internet as unfair, while only around 16% said the restrictions had not had a noticeable impact on their lives.
The most commonly reported consequences included harm to businesses and reduced income (47.5%), disruptions to educational and academic activities (36.1%), reduced access to global news and information (31.9%), and limitations on communication with family and friends (30.7%).
These findings suggest that opposition to internet restrictions extends well beyond technology professionals and digital rights advocates. A significant portion of the population has experienced the economic, educational, and social consequences of these policies in their daily lives.
The Government's Critical Statement Directed at State Television
On May 28, the Government Information Council issued a statement defending the Special Committee for the Organization and Governance of Cyberspace's decision. The statement directly criticized Iran's state broadcaster, accusing it of reflecting only opponents' views after the restoration of internet access and of providing a platform primarily to government critics.
The Government Information Council's response indicated that the dispute over the future of the internet had escalated into a broader political and institutional conflict, with different branches and bodies of the state openly responding to one another through the media.
The Uncertain Future of Internet Pro
On May 26, as internet traffic began to be restored, the Internet Pro page in Hamrah-e Aval's “My MCI” application became inaccessible. One day later, several media outlets reported that Hamrah-e Aval had sent text messages to Internet Pro subscribers informing them that, if they wished, they could deactivate the service and use their remaining data allowance at a later date.
However, Filterwatch continues to receive reports from inside Iran indicating that some users are still receiving promotional SMS messages advertising Internet Pro. These reports also suggest that the service remains available for purchase through USSD codes for certain customers.
Key Developments in Internet Connectivity
The First Signs of Recovery Driven by Internet Pro
Beginning on May 18, Cloudflare's measurements recorded a gradual increase in inbound traffic to Iran. A significant portion of this growth was concentrated on mobile operators and appears to have been driven primarily by whitelisted access, the expansion of Internet Pro users, and the emergence of new censorship-circumvention services and techniques.
The distribution of this traffic was not uniform across operators. Hamrah-e Aval (AS197207) showed stronger indications of stable access to the global internet, while Rightel (AS57218) maintained a limited but relatively consistent level of connectivity. By contrast, Irancell (AS44244) exhibited a substantial gap for most of the month between the presence of network infrastructure and actual access to the global internet.
The Beginning of a Long and Uneven Traffic Recovery
After weeks of faint and unstable increases, the charts showed something different for the first time on Tuesday, May 26, at around 12:00 UTC.
For the first time in 88 days, network measurement systems recorded signs of a gradual restoration of international connectivity. This shift did not initially appear in users' everyday experience, but rather in network graphs and monitoring points, where the first indications of recovery began to emerge.
Based on Kentik data, Doug Madory reported at around 12:00 UTC that only a limited number of networks were showing signs of recovery. These included Mobinnet (AS50810) and the Telecommunication Company of Iran (AS58224). At that point, his data showed no indication that mobile operators had yet resumed international connectivity.
Minutes later, the scope of the recovery appeared to broaden. Additional networks began to appear in Kentik's data as having reconnected to international traffic, including the Islamic Republic of Iran Broadcasting (IRIB) (AS42586), Asiatech (AS43754), and Gostaresh Ertebatat Mabna (AS51074).
Meanwhile, IODA also recorded a sharp increase in its Active Probing metric beginning around 12:00 UTC, a signal typically indicating improved network reachability and connectivity.
At around 13:30 UTC, despite the increases observed in some network measurements, comparisons with longer-term traffic baselines showed that Iran remained far from returning to the volume of international internet traffic recorded before January 8.
By around 14:30 UTC, additional reports began to emerge indicating that connectivity for residential users had been restored. Services such as Google Play and the App Store became accessible again, primarily over fixed-line connections, although access proved unstable, with both services experiencing interruptions and temporary reblocking shortly afterward.
Several hours later, beginning at approximately 16:30 UTC, clearer signs of recovery appeared on mobile networks. Cloudflare data showed that between roughly 16:30 and 20:30 UTC, about 29% of the HTTP requests observed from Iran originated from the Irancell network, while approximately 22% came from Hamrah-e Aval.
Lantern's data also indicates that the restoration process began on fixed-line networks before expanding to mobile operators approximately four hours later.
However, an increase in the number of connected devices did not necessarily translate into a corresponding improvement in connection quality. According to Lantern researchers, while the number of connected users rose rapidly, actual traffic volumes and overall communications capacity remained at relatively low levels. This suggests that users were once again able to connect to the network, but continued to face significant limitations in both the quality and extent of their access.
A comparison of operator-level data further shows that the volume of traffic recorded on Irancell was higher relative to the number of connected devices than on Hamrah-e Aval. This pattern may indicate less aggressive traffic restrictions, higher traffic allowances, or differences in how measurement tools perform across these networks.
Although it is still too early to speak of a full restoration of internet access, May 26 can be regarded as the day when the first observable signs of international traffic returning to Iran appeared after 88 days. For now, however, this recovery remains partial, uneven, and highly variable across different networks.
The Second Day of Partial Internet Restoration
- By the early hours of Wednesday, May 2, internet traffic in Iran had reached a peak of approximately 39% of its pre–January 8 level. In terms of its recovery pattern, this level closely resembled the period of partial restoration observed between January 27 and February 28, before the outbreak of the conflict and the subsequent reimposition of internet disruptions.
- By around 11:00 a.m. Iran time on the second day, user reports indicated that despite the relative increase in traffic, connectivity had not yet stabilized. Connections remained slow and unreliable, and some VPN services had become inaccessible.
- By approximately 16:00 Iran time, more than 24 hours after the restoration process began, Iran's internet traffic had reached roughly 41% of its pre–January 8 level at its peak. This figure remained below the levels observed during the earlier period of partial restoration between January 27 and February 28, before the outbreak of the conflict and the subsequent reimposition of internet disruptions.
- By around 22:00 Iran time that same day, Iran's internet traffic had risen to 49% of its pre–January 8 level.
During this period, as internet traffic in Iran was gradually increasing, users encountered another limitation: Google's SMS verification service effectively stopped working for users inside the country. After nearly three months of disrupted internet access, many users attempting to log in to their Google accounts found they were unable to receive Google's verification codes for two-factor authentication, account recovery, or the creation of new accounts.
Later that day, Iranian media outlets reported that access to major app marketplaces, including Apple's App Store and Google Play, had been restored within Iran.
The Third Day of Partial Internet Restoration
- By around 9:00 a.m. Iran time on the third day, internet traffic had risen to 53% of its pre–January 8 level.
- Two days after the restoration process began, Behzad Akbari, CEO of the Telecommunication Infrastructure Company (TIC), posted on X, alongside a chart showing traffic levels at 16:30 Iran time on May 28. He wrote:
“Improving service quality and restoring international traffic takes several days due to the prolonged nature of the disruptions. The chart below illustrates the upward trend in international traffic. Please be patient.”
His statement marked one of the first public acknowledgments by a senior telecommunications official that the recovery process was still ongoing and that service quality had not yet fully returned to normal.
On the same day, several network specialists in Iran told Zoomit that internet quality remained unsatisfactory for the first 48 hours after the restoration. They pointed to persistent disruptions across multiple layers of the network, including:
- Widespread disruption of UDP traffic and instability in TCP connections, resulting in degraded performance or service interruptions across a range of applications and services.
- Problems with SSH access and the continued unavailability of parts of the infrastructure associated with content delivery networks (CDNs), affecting the performance of some domestic services as well.
- Ongoing DNS-related issues, increased network latency, and a noticeable deterioration in overall user experience.
- The continued failure of Firebase channels to function properly, resulting in disruptions to push notifications across many applications and platforms.
Reaching 60% on the Fourth Day
- By midday on Friday, May 29, three days after the partial restoration of internet traffic began, observed traffic volumes had reached approximately 60% of the levels recorded before January 8.
Iran's internet remains far from a full return to normal. For this reason, the developments of recent days should not be viewed as marking the end of the country's internet crisis. Rather, they may mark the beginning of a new phase in the evolving relationship among the state, communications infrastructure, and Iranian users' right to access the global internet.