{"id":1895,"date":"2019-04-19T05:08:15","date_gmt":"2019-04-19T05:08:15","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=1895"},"modified":"2025-05-11T08:05:55","modified_gmt":"2025-05-11T08:05:55","slug":"fatawatch-01-iranian-cyber-police-monitoring","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2019\/04\/19\/fatawatch-01-iranian-cyber-police-monitoring\/","title":{"rendered":"FATAwatch\/\/01 \u2014 Iranian Cyber Police Monitoring"},"content":{"rendered":"
\n
\n

Welcome to the first edition of FATAwatch \u2014 Small Media\u2019s new quarterly report seeking to scrutinise the operations of Iran\u2019s Cyber Police (or FATA), and to better understand their growing role in monitoring and regulating Iran\u2019s online environment.<\/p>\n

FATA was founded in 2011 in the aftermath of the digitally-empowered mass protests that followed the disputed presidential elections of 2009. Dogged by controversy in its early years, and implicated in the\u00a0death of blogger Sattar Beheshti<\/a>\u00a0in 2012, FATA has in recent years maintained a comparatively low profile. Regardless, in October 2018 FATA announced that it had arrested a total of nearly 75,000 people in its seven years of operation.<\/p>\n

Despite this striking figure, we have seen relatively little scrutiny applied to FATA\u2019s operations \u2014 especially compared to other organisations such as the \u2018Iranian Cyber Army\u2019 or the Iranian Revolutionary Guard Corps, which target diaspora-based activists and foreign governments.<\/p>\n

Although cyber policing units often undertake legitimate work countering online crime, we believe that owing to its history and Iran\u2019s wider record on information controls, FATA requires a higher degree of scrutiny than it\u2019s currently being afforded. This is the gap that FATAwatch aims to fill.<\/p>\n

This first edition of FATAwatch covers the public operations of FATA from January\u2013March 2019.<\/p>\n

Want to learn more about FATA?<\/strong>\u00a0Our team recently produced an extensive report on FATA\u2019s origins and operations \u2014read it here<\/a>.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
<\/div>\n

<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

\n
\n

Our work here aims to demonstrate the extent of FATA\u2019s operations nationwide, while highlighting disparities in enforcement across different regions and political contexts inside Iran.<\/p>\n

The data presented in this report is collected from the\u00a0official FATA website<\/a>, and is based solely on the reports published by FATA itself. Therefore the figures presented here should not be understood as documenting the total number of arrests made by the agency, but instead as a reflection of how FATA chooses to publicly present itself and its law enforcement priorities.<\/p>\n

In these reports, we will also monitor the charges brought against individuals detained by FATA, which can for the most part be classified within the following three groups:<\/p>\n

    \n
  1. Illegal Products & Services\u00a0<\/strong>\u2014 These charges include the sale of goods such as weapons and drugs, as well as services including gambling or prostitution.<\/li>\n
  2. Financial Crimes<\/strong>\u00a0\u2014 These are mostly linked to phishing, online scams, and other types of fraud.<\/li>\n
  3. Moral Crimes\u00a0<\/strong>\u2014 These charges include stalking, spreading rumours, revenge porn, or other crimes involving the publication of content deemed immoral or illegal. Some of these crimes will have had financial motives, but FATA has instead presented them as moral crimes.<\/li>\n<\/ol>\n

    In each province we record the numbers of those that FATA has arrested and\/or identified and referred to the judiciary. We also monitor the apps and websites that FATA associates with reported criminality. This enables us to develop a better understanding of the reach of the organisation\u2019s monitoring, and their approach to and perceptions of different apps and platforms.<\/p>\n

    In addition to the quantitative presentation of FATA data, we\u2019ll also highlight any notable public statements or security warnings issued by FATA officials during each quarter.<\/p>\n

    So that\u2019s how we got the data. Now, let\u2019s see what we found.<\/p>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \n

    One of the clearest findings from the arrest data is that there\u2019s a very uneven distribution of reported arrests among provinces. Hormozgan saw the highest number of arrests by quite some margin, with 24 people identified or arrested. It should be noted that 16 of these arrests came from a single case relating to financial crimes in January 2019.<\/p>\n

    This data could suggest that Hormozgan, Isfahan and Khorasan Razavi implement tougher law enforcement strategies than other provinces, or it could just be that their provincial forces have a more active an engaged media team. As FATAwatch continues, and we collect more long-term data, we should be able to develop some deeper insights into these nationwide dynamics.<\/p>\n

    Regardless, we can understand from these nationwide figures that FATA has been presenting itself firstly as operating to counter financial crimes, with these reported crimes typically outweighing morality-related crimes or those relating to illegal services.<\/p>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \n

    In the three provinces with the highest number of arrests financial crimes are the most heavily reported. Telegram and Instagram are the two platforms that seemingly received the greatest level of scrutiny within this group, as well \u2014 though in Isfahan and Khorasan Razavi there were also a high number of reports that failed to specify a particular platform.<\/p>\n

    \u2018Other\u2019 platforms are those which were either not determined by name, or else described in very vague terms. This category will include reported crimes conducted via email, malware, and other indeterminate methods.<\/p>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \n

    The arrests and identification of criminals was heavily linked with the platform\u00a0Telegram<\/strong>. There could be a couple of reasons for this.<\/p>\n

    Firstly, authorities have an incentive to make noise about criminal incidents on Telegram \u2014 the app is filtered, and so by emphasising the prevalence of criminal activities on the platform, authorities further justify the filtering of the app.<\/p>\n

    Secondly, many of the arrests were linked to activities taking place on public groups, and so it may well have simply been easier for authorities to identify online criminals on Telegram than on alternative platforms.<\/p>\n

    By comparison, the record of arrests links\u00a0Instagram<\/strong>\u00a0more closely to morality-related crimes. A number of these arrests were made relating to harassment or online stalking. In all of the cases mentioned, the victim (or victims) were female.<\/p>\n

    The only two Iranian platforms that were named as being used for criminal activities were\u00a0Sheypoor<\/strong>\u00a0and\u00a0Divar<\/strong>\u00a0\u2014 two sites used for sharing classified advertisements. All of the crimes noted on these platforms related to financial crimes.<\/p>\n

    The high prevalence of crimes committed on \u2018Other\u2019 platforms could be reflective of a couple of things \u2014 firstly, the vagueness of a number of FATA\u2019s press releases, and secondly, the likely ongoing prevalence of fraud and exploitative criminal activity using other methods such as email, malware, and malign apps.<\/p>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

    \n
    \n

    During this reporting period, a handful of arrests fell outside the three categories of criminal activities that we have formulated, and are categorised as \u2018Other\u2019 crimes in our dataset:<\/p>\n

    5 January 2019<\/strong><\/a>\u00a0<\/strong>\u2014\u00a0Whistleblowing<\/strong><\/p>\n

    FATA (Khuzestan) reported the arrest of a number of Iranians for publishing the \u201cconfidential documents\u201d of an organisation on WhatsApp. FATA did not specify whether the institution referred to is a private company or a public institution.<\/p>\n

    11 March 2019<\/strong><\/a>\u00a0<\/strong>\u2014\u00a0IRIB Poll Manipulation<\/strong><\/p>\n

    FATA announced the identification and arrest of an individual behind the manipulation of a poll conducted by IRIB.<\/p>\n

    31 March 2019<\/strong><\/a>\u00a0\u2014\u00a0Khuzestan Bar Association Hacked<\/strong><\/p>\n

    FATA (Khuzestan) announced that a teenager was arrested for hacking the website of the province\u2019s Bar Association. According to FATA, the teenager carried out the crime in order to \u201cdemonstrate his skills\u201d.<\/p>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

    \n
    \n

    FATA also made a number of announcements and warnings over the course of the first quarter:<\/p>\n

    1 January 2019<\/strong><\/a>\u00a0<\/strong>\u2014\u00a0Financial Motives For 80% of Cyber-Crimes<\/strong><\/p>\n

    Colonel Hussein Ramazani of FATA announced that more than 80% of cyber-crimes committed in Iran have financial motives.<\/p>\n

    5 January 2019<\/strong><\/a>\u00a0<\/strong>\u2014FATA Warns of Illicit Gambling<\/strong><\/p>\n

    The AFC Asian Cup saw a rise in FATA\u2019s warnings on gambling online. Unsurprisingly, many of those offering illegal gambling opportunities online were seeking to attract Iranian football fans.<\/p>\n

    General Warning<\/strong>\u00a0\u2014\u00a0Harassment on the Rise<\/strong><\/p>\n

    In this quarter there have been a notable number of cases reported by FATA in which women have reported harassment or blackmail, particularly relating to women being threatened with the release of their private photos. In response, FATA officials strongly advised women not to post private photos online, as they may be used against them.<\/p>\n

    General Warning<\/strong>\u00a0\u2014\u00a0FATA Issues Warnings on Flood Misinformation<\/strong><\/p>\n

    On a number of occasions in this reporting period, FATA warned the public against spreading rumours or inaccurate news regarding the floods in Iran.<\/p>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n

    \n
    \n

    In this first edition of FATAwatch, we\u2019ve sought to demonstrate the depth of the data available to us through monitoring FATA\u2019s public reporting of arrests and criminal cases.<\/p>\n

    The data we have gives us hints about the possible existence of a few stories, but we\u2019ll need more data before we can begin to develop any solid conclusions about long-term trends. Nonetheless, here are some of the things we\u2019re going to be looking out for in future instalments of FATAwatch:<\/p>\n