{"id":1867,"date":"2019-08-19T04:39:34","date_gmt":"2019-08-19T04:39:34","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=1867"},"modified":"2025-05-11T08:05:55","modified_gmt":"2025-05-11T08:05:55","slug":"fatawatch-02-iranian-cyber-police-monitoring","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2019\/08\/19\/fatawatch-02-iranian-cyber-police-monitoring\/","title":{"rendered":"FATAwatch\/\/02 \u2014 Iranian Cyber Police Monitoring"},"content":{"rendered":"
\n
\n

This edition of FATAwatch covers the second quarter of 2019, between April 1 and June 30 (Q2). This is the second part in a series covering the activities of Iran\u2019s Cyber Police (FATA), as reported on their official website.\u00a0The first edition of the series \u2014 covering 1 January to 31 March (Q1) \u2014 and the methodology used to collect and classify the data, can be found here<\/a>.<\/p>\n

In the current edition we share some of our preliminary findings with the goal of publishing our detailed study after collecting further data over the course of one year.<\/p>\n

In this quarter,\u00a0206<\/strong>\u00a0criminal cases were reported on FATA\u2019s website which is a significant rise from\u00a0125<\/strong>\u00a0in Q1. During the second quarter of this year, there were\u00a0253<\/strong>\u00a0arrests associated with these cases, which is also up from\u00a0163<\/strong> in Q1. Unlike Q1, the mobile app most frequently associated with criminal cases overall by FATA is Instagram, not Telegram.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

Significantly, during this period, Iran was tragically ravaged by a series of heavy floods which caused widespread devastation across a large number of provinces resulting in at least 77 deaths overall. As part of its response, FATA sought to contain the flow of information on social media during these events by issuing a series of warnings about the spread of misinformation and fraud online.<\/p>\n

Their response also included the arrests of a number of social media users and online account administrators. However, it remains unclear the dissemination of which content by these users was perceived as criminal by FATA.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
\n
\n

In March, the head of FATA, Chief Brigadier General Kamal Hadianfar, was replaced by his former deputy, Brigadier Vahid Majid. There is very limited information available on Majid\u2019s background and record within FATA, although owing to his previous seniority in the organisation, it is not expected that his appointment will usher in any significant policy shifts.<\/p>\n

During the past three months Majid has maintained similar public engagements as the previous chief and also on delivering FATA\u2019s response to high profile news events. For example, on\u00a018 June<\/a>, Majid took part in a meeting with journalists in Tehran, during which he emphasised the role of FATA in identifying 400 web pages in Iran which were involved in the sale of firearms.<\/p>\n

He also added that since 30 April 2019, 38 people had been arrested in connection with promoting violence online in Iran (these statistics are not included in this report as they were only mentioned at a press conference and not reported on any official websites). This was largely in reaction to the murder of a cleric in April by an individual who had previously posted pictures of himself with guns on Instagram, causing\u00a0Iran\u2019s Supreme Leader<\/a>\u00a0to call on the police to deal with the the issue of promotion of violence online.<\/p>\n

On\u00a026 June<\/a> Colonel Hossein Amirli was announced as Majid\u2019s new deputy.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
\n
\n

As noted above, during this quarter tragic floods\u00a0struck<\/a>\u00a0Iran in April, killing 77 Iranians and causing more than $22bn in damage. Throughout the crisis, FATA issued numerous warnings relating to online misinformation, warning citizens not to trust reports appearing on social media platforms relating to the ongoing disaster. FATA also\u00a0asked citizens<\/a>\u00a0to be especially wary of social media posts asking for donations, warning that a number of fraudsters were seeking to profiteer off the back of citizens\u2019 generosity. This is not a unique occurrence, with FATA\u00a0regularly issuing<\/a>\u00a0similar donation warnings during religious holidays.<\/p>\n

The urgency of the situation, and the need to provide citizens with official updates and advice caused government officials to temporarily suspend their opposition to the use of the communication app Telegram. Government agencies soon began\u00a0posting<\/a>\u00a0official notices on the platform, although it remained filtered \u2014 a tacit admission of the app\u2019s continued ubiquity.<\/p>\n

However, during this time FATA was also responsible for a harsh crackdown on social media users. Mass arrests of social media users by FATA on charges of \u201cspreading rumours\u201d and \u201cprovoking public reactions\u201d are deeply concerning, as for many years similar charges have been used to target print media journalists across Iran. The fact that these arrests took place during a period of crisis and widespread misinformation should not exempt them from proper scrutiny.<\/p>\n

One incident not shown in the data below is FATA\u2019s arrest of 24 social media users in the Khuzestan province in April. A\u00a0report<\/a>\u00a0published on 12 April refers to Khuzestan\u2019s Chief of FATA\u2019s comments, stating that 24 people were arrested for creation of \u201canxiety and unease in the public\u2019s mind\u201d and spreading \u201cfalse rumours\u201d. The news of the arrests were not reported on FATA\u2019s official website and there is little information available on what exactly the supposed false news was.<\/p>\n

FATA uses the same rhetoric to arrest social media users who criticise public figures. On\u00a010 June<\/a>, MP for the city of Arak, Seyyed Mehdi Moghadasi, thanked FATA for identifying the individuals responsible for publishing \u201cfalse information\u201d about public officials. There is no information about the people arrested other than the information released by FATA stating that they were administrators of a Telegram group with 5,000 members.<\/p>\n

These announcements from FATA receive very little by way of public scrutiny, while at the same time individuals arrested under these charges are likely to be pressured not to publicly disclose the details of their case. In this sense, it is possible that FATA could bring cases against journalists, concerned citizens or campaigners with zero accountability. FATA\u2019s reliance on oppressive laws such as Article 698 of the Islamic Penal Code allows them to use their powers to silence citizens who voice legitimate concerns about officials\u2019 management of crises such as floods.<\/p>\n

In the absence of transparency and legitimate oversight of FATA\u2019s operations, it is impossible to assess whether the organisation is implementing these measures in a proportionate way to protect individuals\u2019 reputations or rather to simply repress politically challenging speech.<\/p>\n

Currently, FATA relies heavily on the Computer Crimes Law and the Islamic Penal Code for bringing charges unrelated to financial crimes. These two pieces of legislation have been used in high-profile cases such as the case of\u00a0Amir Hossein Miresmaili<\/a>\u00a0and\u00a0\u201cOperation Spider\u201d<\/a> to suppress freedom of speech, and it is entirely possible that they are being applied by FATA in a similar way in the cases outlined above.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
\n
\n

During Q1 and parts of Q2 of 2019 when Hotgram and Golden Telegram (Iranian copies of the Telegram app) appeared to be bypassing the ban on Telegram with some support from Iranian officials, FATA regularly raised concerns about the messaging apps, constantly linking them to criminal or immoral activities. However these domestic versions were finally shut\u00a0down in June<\/a>, meaning that since June Iranians have not had any state sanctioned way of accessing Telegram. It is to be seen if in Q3 FATA will continue associating criminal activities with Telegram or not.<\/p>\n

However it is noticeable that In Q2 FATA has also started targeting Instagram and associating it with criminal activities. This coincides with some judiciary officials and hardliners in Iran seeking to ban the platform.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

As documented here, the number of criminal cases associated with Instagram has risen from 21 in the Q1 of 2019 to 52 in Q2. This means that unlike the last reporting period, FATA has associated more crimes with Instagram than Telegram.<\/p>\n

The most notable offenses which FATA targets on Instagram appears to be blackmail, gambling and harassment.\u00a0As we previously reported<\/a>, FATA continues to apply pressure on influencers on the platform, asking them to adopt FATA\u2019s standards of \u201cmodesty\u201d This also suggests that FATA views Instagram more as a cultural threat than one of cyber security or financial crime.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
\n
\n

On\u00a019 June<\/a>, Colonel Amin Yadgarnejad who is the head of FATA in Kerman province claimed that 65% of cybercrimes since March were financial in nature. He also warned that compared to the same period last year, there has been an 80% increase in financial crimes.<\/p>\n

From reviewing items posted on FATA\u2019s website for Q2 of 2019, there appears to be a number of possible underlying causes that can be attributed to this rise. Amongst them could be the growth of Iran\u2019s digital economy, diversity of ways to access social media platforms due to the filtering regime, peer-to-peer trading, and, Iran\u2019s eGovernment project. For example on\u00a030 June<\/a>, FATA in Kerman Province warned of a phishing campaign pretending to be an official government page requesting financial aid for low-income families.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

This highlights the urgent need for Iran to establish comprehensive data protection rules and bodies. In the absence of proper protections, ensuring the right of Iranian internet users and outlining the responsibilities of governmental bodies and private sector, the growth of eGovernment services and digital economy may further risk the security of Iranian internet users.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
<\/div>\n

<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

\n
\n

Notably, so far, FATA has not reported any criminal activity associated with domestic messaging apps. This may simply be due to the fact that these apps have a smaller user base than their mainstream global rivals but it\u2019s also possible that FATA has few incentives to report on fraud and security breaches on state-supported apps that the government is working so hard to promote.<\/p>\n

The only two Iranian platforms featured by FATA in this report are\u00a0Divar<\/a>\u00a0and\u00a0Sheypoor<\/a>\u00a0(both are classified advertisements websites).<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
<\/div>\n

<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

\n
\n

It is also notable that there are only three provinces that have reported no arrests within the first six months of 2019. These are East Azerbaijan, Southern Khorasan, and Qom.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

FATA has reported 310 criminal cases in Q1 and Q2, bringing the total for the first half of 2019 to 416 arrests. Note that these are only the arrests reported on FATA\u2019s official website; as mentioned above, there are examples of news agencies reporting additional arrests that went unreported by FATA .<\/p>\n

Although there were significantly more arrests reported by FATA in Q2, the proportion of financial crime remains roughly the same as the previous quarter, at around 60% of the total.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
<\/div>\n

<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

\n
\n

Looking at the results of FATAwatch for Q1 and Q2, there are some observations that we can report at this stage:<\/p>\n

    \n
  • It appears that not all of FATA\u2019s activities are reported on their official website. As pointed out earlier the arrest of 24 social media users in the Khuzestan province did not appear on FATA\u2019s website (and therefore omitted from numbers here).<\/li>\n
  • There is a clear correlation between FATA officials\u2019 political messaging and crimes reported on their website. In this year\u2019s Q1, when Telegram was the app most associated with cybercrimes, FATA officials were advocating in favour of shutting down Iranian copies of the app while during Q2 reporting period they have made a number of interventions against Instagram which is now the platform most associated with cybercrimes, replacing Telegram.<\/li>\n
  • FATA\u2019s monitoring of social media accounts and arrests made in the name of \u201cfalse news\u201d poses a serious danger to freedom of speech and citizen journalism. This is especially troubling when it is used to protect public figures and relies on legislations that have over the years been used to limit the freedom of journalists in Iran.<\/li>\n<\/ul>\n

    What is clear is that FATA is not receiving adequate scrutiny and oversight from domestic forces. Armed with the most oppressive laws in Iran, they are rarely questioned about the details of the arrests made by them. It is also possible that those arrested by FATA for short periods are regularly urged to not publicise the details of their case, contributing to FATA\u2019s ability to continue with their penalising of Iranians without appropriate oversight<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    This edition of FATAwatch covers the second quarter of 2019, between April 1 and June 30 (Q2).<\/p>\n","protected":false},"author":4,"featured_media":1869,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[113],"tags":[56],"class_list":["post-1867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threat-reports","tag-fatawatch","entry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t