Developments over the past month show that communications controls are expanding rapidly into every layer of users’ digital lives. This includes official announcements targeting satellite internet technologies, cutting off SIM cards and phone lines of Instagram-based businesses, conditioning infrastructure access on identity verification, and linking services and network resources to real-world identities. Taken together, these tools and practices mean that control is no longer limited to the pathways that users take to access the internet. Instead, user identities, communication tools, businesses, IP addresses, and even their access to everyday services are increasingly becoming points of pressure and control.
Meanwhile, the state of the network itself shows no sign of returning to normal. Throughout the month, users reported widespread VPN instability and short, recurring disruptions to international internet connectivity. A fresh decline in Iranian traffic on Cloudflare’s network, coinciding with these disruptions, heightens concerns that filtering tactics are shifting toward specifically targeting censorship-circumvention tools.
Key Findings
- Government concern over declining filtering effectiveness against satellite internet: Recent Direct to Cell trials around the world, which can render traditional network-control tools ineffective, have prompted the government to resort to threats of signal jamming, power cuts, and diplomatic pressure. Technical assessments, however, indicate that attempts to completely shut down Starlink across Iran in January 2026 also failed and that achieving a nationwide shutdown is not technically feasible in the future either.
- SIM cards transformed from communication tools into instruments of punishment: Blocking the mobile and landline services of online businesses, and making reconnection conditional on “content clean-up” and compliance with dress-code rules, has turned infrastructure access directly into a tool for economic punishment and enforced self-censorship.
- Identity verification made a precondition for infrastructure access: Mandatory visual identity verification at IRNIC, together with the registration of end-user identities for international internet access on domestically hosted servers, has created an “identity–phone–IP” chain that strengthens and institutionalizes regulatory tracking of digital activity back to specific individuals.
- Inadequate regulatory response to "data depletion" complaints: Although the regulator rejected the existence of systematic under-delivery, its own assessment confirmed that some domestic IP addresses that had not been properly updated were being charged at international traffic rates. This issue cannot be resolved without providing auditable itemized usage records and independent verification.
- Gap between official statistics and network reality: The CEO of the Telecommunication Infrastructure Company claimed that traffic had recovered to 90% of its previous level, a figure inconsistent with independent Kentik data, which places it at around 60%. At the same time, severe VPN instability, recurring disruptions to international connectivity, and a decline in Cloudflare traffic suggest filtering is shifting toward selectively targeting circumvention tools.
Part One: Policy
From Network Control to a War on Satellite Connectivity
While telecom operators globally test Direct-to-Cell technology to expand coverage and reduce reliance on terrestrial infrastructure, Iranian authorities are taking an increasingly aggressive stance against these emerging tools.
On September 14, Italian operators Fastweb and Vodafone, in partnership with Starlink, successfully connected a standard 4G smartphone directly to Starlink’s satellite network using Direct to Cell technology in an area without mobile network coverage, requiring no satellite dish or antenna. During the trial, the phone was able to receive text messages and mobile data and run services including WhatsApp video calls and Google Maps.
In Iran, where satellite options reduce reliance on state-controlled infrastructure, the government has expanded countermeasures beyond traditional filtering and blackouts. These now include radio-frequency jamming, equipment confiscation, criminalization, power cut threats, and diplomatic pressure. During the nationwide internet shutdown in January 2026, media outlets reported Iran using jamming and electronic warfare equipment to disrupt Starlink. Those reports have now, for the first time, been officially acknowledged at the highest level of Iran’s cyberspace policymaking apparatus. On October 5, Seyed Mohammad Amin Aghamiri, Secretary of the Supreme Council of Cyberspace, stated that Iran managed to disable Starlink terminals “in a controlled manner” during what he termed the “January coup,” adding that additional countermeasures remain available. An expert from the NasNet group told Filterwatch that Iranian officials’ claims of having “disabled Starlink” do not align with observations on the ground:
“The repeated claims by Islamic Republic officials that they shut down Starlink do not match what we actually saw. In January, they were able to disrupt Starlink connectivity in some parts of Tehran, but what happened was more like a three- to four-day technical confrontation. The Islamic Republic was jamming Starlink connections, while Starlink kept releasing updates that allowed terminals to start working again.”
Describing the changes Starlink made during the January protests, the expert added:
“Before these updates, packet loss in some parts of Tehran reached as high as around 80 percent. After Starlink made changes, that figure dropped to roughly 10 percent, and after about four days the connection reached a relatively stable state. During the disruption, Starlink also limited upload speeds to around 1 Mbps, while download speeds remained almost normal throughout.”
He also stressed that the Iranian government’s efforts to disrupt Starlink are continuing:
“The Islamic Republic has never been able to completely disable Starlink across Iran, even for a single moment. Technically, it can deploy jamming equipment and cause disruption in parts of major cities, but extending that level of disruption across the entire country is not feasible. Starlink is also not defenseless against these measures and has the ability to adapt and respond technically. The experience of the war in Ukraine has also shown that even Russia has been unable to shut Starlink down completely.”
On October 4, one day prior to Aghamiri’s statement, the Director General for International Peace and Security at Iran’s Ministry of Foreign Affairs summoned the Norwegian ambassador and formally called on Norway to take action to halt Starlink’s activities in Iran.
Additionally, Iran’s deputy minister of communications recently warned that the government may cut electricity during future crises to disrupt satellite networks operating independently of domestic infrastructure.
Recent statements by Iranian officials about Starlink reflect the government’s growing concern over the technology. As satellite internet moves away from dedicated dishes and toward direct connectivity with ordinary mobile phones, Iran’s traditional model of internet control—based on control over operators, the international gateway, DPI, and network shutdowns—loses some of its effectiveness. Consequently, state policy is pivoting toward spectrum control, physical control over equipment, punishment of users, disruption of supporting infrastructure such as electricity, and international pressure on service providers.
From SIM Card Cutoffs to the “Blackout”: Communications Infrastructure Becomes a Tool of Punishment
SIM card disconnections are not new in Iran. Filterwatch research shows that this measure has been used since at least the summer of 2024 against journalists, civil society activists, students, and owners of online businesses. However, September 2026 saw a sharp expansion of this practice, locally labeled the “blackout”, along with the introduction of content-control requirements as a condition for restoring blocked lines.
According to a Zoomit report, following the 12-day war, Instagram business owners were forced to “clean up” their pages according to guidelines from the Fashion and Clothing Organization Working Group in order to have their phone lines restored.
The process includes pledging to remove “criminal” content, providing the addresses of all pages and channels, and complying with detailed rules governing clothing, the display of the body, and product advertising. Reconnection of phone lines is also made conditional on review and approval by the working group. In this way, access to telecommunications services—and the ability to continue operating a business—is tied to compliance with censorship and enforced self-censorship.
This mechanism forms part of a broader expansion of digital and economic repression, particularly targeting women—a shift Filterwatch has previously documented. Blocking a SIM card creates a form of “silent, cascading punishment,” because mobile phone numbers have become gateways to banking, judicial, university services, online shopping, transportation, and even some urban mobility services.
Identity Verification: From User Verification to Controlling Access to Infrastructure
Last month, the mandatory introduction of “visual identity verification” for individual users at IRNIC sparked widespread discussion on social media. Although verification to prevent fraud in domain registration is a reasonable measure, making the collection of sensitive visual data mandatory—without offering less intrusive alternatives or clearly explaining why such data is necessary—does not align with data protection and digital rights standards. This move by IRNIC, alongside similar practices introduced by hosting companies, points to a broader trend toward linking digital services and IP addresses more closely to individuals’ real identities.
This move mirrors practices across Iranian web hosts, highlighting a broader shift toward binding digital resources and IP addresses directly to real-world identities. Since July 2026, as data center connectivity was restored, enabling international internet access on domestic servers became conditional on user identity verification. Data centers and intermediary hosts must verify identity, linking assigned IP addresses to phone numbers registered under the user's national ID.
While identifying IP owners via the Shahkar system is not new, the critical shift is that identity registration is now an active precondition for network access. International internet access remains disabled until Shahkar verification is complete, turning identity checks into a gateway for network access.
Users on X (formerly Twitter) have documented these enforcement mechanics across service providers. For example, ParsVDS implemented a five-step identity and address registration process within the “Data Center Services Management System,” while Mizbanfa made cPanel credentials and Shell Access contingent on Level 2 identity verification. Without full registration, administrative controls, and international connectivity remain locked.
“Data Depletion”: An Audit Without Independent Verification
One of the recent complaints from users about the state of Iran’s internet concerns what has become known as “data depletion”: internet packages running out unusually quickly compared with previous months. After these complaints intensified, the regulator announced that random tests of fixed and mobile operators’ data packages had found no discrepancy in the amount of data recorded. However, the same report also confirmed that a significant number of IP addresses and domestic content addresses had not been registered or updated in the preferential-tariff system. As a result, in some cases traffic that should have been charged at the domestic rate was instead deducted from users’ packages as international traffic.
Regardless of the cause, the outcome for users is effectively what they describe as “data depletion”: their internet packages are consumed faster than expected because some traffic is deducted at a higher rate than it should be. Therefore, the fact that a system records “one gigabyte as one gigabyte” in a particular test does not, by itself, address users’ complaints. The issue is not only how many bytes are counted, but also how those same bytes are classified and at what tariff they are deducted from a user’s package.
The regulator has also cited higher volumes and quality of video content, automatic software updates, autoplay, cloud backups, and background app activity as reasons why users’ packages may be depleted more quickly. These factors are certainly real, but they are not new and, on their own, do not explain why users have specifically reported a noticeable change in the rate at which their data packages are being consumed in recent months.
More importantly, the regulator’s review relied largely on random testing and assessments of systems that the regulator itself is responsible for overseeing, rather than on independent verification of specific user complaints during the periods in question. A measurable and verifiable response to these complaints would require each user to have access to auditable, itemized usage records showing the time of consumption, exact volume of data used, whether the traffic was classified as domestic or international, and the tariff applied to each record. That information would also need to be independently verifiable. Until such data is available, the findings of a limited audit cannot be considered sufficient to close the case on “data depletion.”
Part Two: The State of Iran’s Internet Network
On September 14, Behzad Akbari, CEO of the Telecommunication Infrastructure Company (TIC) and deputy minister of communications, claimed international traffic had largely recovered, stating: “In terms of traffic, we are now at 90 percent of the international traffic level we had in January.”
However, data from network monitoring firm Kentik contradicts this claim. Doug Madory, Kentik’s Director of Internet Analysis, shared the latest chart of Iran’s internet traffic with Filterwatch and said: “According to our data, Iran’s traffic is still at around 60 percent of its pre-January 8 level.”
Throughout the month, users experienced severe VPN instability and unpredictable performance across different operators. Circumvention tools often failed on one provider while remaining functional on another. A recurring pattern was the temporary loss of international connectivity while domestic network access remained intact—a state users term “Iran Access.”
A notable drop in Cloudflare network traffic from Iran beginning October 4 coincided with user reports of VPN failures and targeted protocol interference, suggesting potential changes in state filtering methodologies. Together, these developments have strengthened speculation that the methods used to enforce filtering and restrict access to the international internet may be changing.
One technical hypothesis is the targeted disruption of circumvention tools relying on Cloudflare’s infrastructure for routing or traffic obfuscation. This would account for severe circumvention failures without producing major BGP routing drops or massive dips in total nationwide bandwidth.
Kentik’s Doug Madory confirmed that this traffic drop was specific to Cloudflare’s network (AS13335) and did not drastically alter Iran's overall inbound/outbound volume.
Senior network engineer Mark Pashmforoush noted that these disruptions often evade traditional monitoring platforms like IODA or Cloudflare Radar:
“IODA and Cloudflare Radar mostly watch routing and whether a network can be reached at all. Most of what users felt in September left both of those intact.”
According to Pashmforoush, at one point every TCI (Mokhaberat) and MCI (Hamrah-Avval) prefix they monitor “dropped to almost zero speed for two hours.” The links remained up, meaning that from outside the network appeared to be functioning, “but nothing useful got through.”
He explained that filtering is increasingly moving toward stealth throttling:
“The filtering increasingly relies on limits that monitors cannot see. We are currently measuring a throttle that allows the first six packets of a TCP or UDP connection to pass normally, after which the connection slows so much that it becomes unusable. ”Because monitoring tools test with short connections, he explained, they may report the network as healthy while real users get almost nothing.”
Regarding “Iran-access,” Pashmforoush noted several technical drivers. International links may fail while domestic traffic continues normally; firewall maintenance can also produce short periods of Iran-access, particularly between 3 and 4 a.m. Tehran time, when firewalls are tuned and updated. A third cause, he said, lies inside Iranian data centers. Many VPN setups pass through a server inside Iran before leaving the country, and if that server loses its foreign internet access, users relying on it remain stuck on Iran-access until the provider reconnects it.
Addressing potential infrastructure overhauls, Pashmforoush concluded:
“So far we see constant tuning rather than a rebuild. The firewall is getting more precise and harder to see from outside. The internet stays technically on while it becomes unusable for the things people need. That makes this kind of censorship harder to measure and harder to prove. This may be a sign of new capabilities.”