{"id":2421,"date":"2020-08-14T16:12:12","date_gmt":"2020-08-14T16:12:12","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=2421"},"modified":"2020-09-03T20:14:04","modified_gmt":"2020-09-03T20:14:04","slug":"irans-legal-vpns-and-the-threat-to-digital-rights","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2020\/08\/14\/irans-legal-vpns-and-the-threat-to-digital-rights\/","title":{"rendered":"Iran\u2019s \u201cLegal VPNs\u201d and the Threat to Digital Rights"},"content":{"rendered":"

On <\/span>13 April <\/span><\/a>this year, the Secretary to the Supreme Council for Cyberspace (SCC) Abolhassan Firouzabadi announced that a regulatory guidance for \u201cLegal VPNs\u201d has been finalised by the Committee for Determining Instances of Criminal Content (CDICC). He also added that the ICT Ministry will be in charge of deciding who will have access to legal VPNs. Since the text of the said regulation has not yet been made publicly available, this has raised confusion and concern among many Iranians.\u00a0<\/span><\/p>\n

This confusion is only natural, given that VPNs are most known to Iranians as circumvention tools that can bypass government filtering; the paradox of authorities implementing a hyper-restrictive filtering regime on the one hand, and legalising a market for bypassing it on the other is perplexing for many people.\u00a0<\/span><\/p>\n

However, the snippets of news that have emerged have been received with concern by Internet users inside Iran. Given the recent history of censorship and surveillance (and the CDICC\u2019s role in implementing this) many have speculated that any new initiatives will seek to further restrict access to information, or to expand the state\u2019s surveillance capacities.\u00a0<\/span><\/p>\n

This announcement \u2013 especially in absence of detail \u2013 may seem far-fetched, or unlikely to materialize. In this edition of Filterwatch, we will look at the historical context around the development of \u201cLegal VPNs\u201d, and in doing so will demonstrate that a form of \u201cLegal VPN\u201d distribution is already in place, and already undermining Iranians\u2019 digital rights. This recent announcement however presents a real threat by expanding on these current practices.\u00a0<\/span><\/p>\n

We will also speculate what form these new \u201cLegal VPNs\u201d might take, and what these developments may mean for digital rights in the short- and long term.<\/span><\/p>\n

We argue that Iran\u2019s continuing work around \u201cLegal VPNs\u201d must be taken seriously as a core component of the state\u2019s overarching strategy to localise the internet, and impose \u201clayered filtering\u201d to grant different levels of access to different social groups. These recent developments demonstrate again that new forms of information controls implemented in Iran may be challenging to detect, and could disrupt existing circumvention strategies in the medium-to-long term.<\/span><\/p>\n

A Defeated Old Project?<\/b><\/p>\n

The first trace of \u201cLegal VPNs\u201d, or state-sanctioned VPNs could be spotted in the final months of the Ahmadinejad administration. On <\/span>17 February 2013<\/span><\/a>, Iran\u2019s National Centre for Cyberspace (NCC) opened up registrations for receiving \u201cLegal VPNs\u201d. The online registration process was hosted at \u201cvpn.ir\u201d, and was open to organisations and individuals who held posts that \u201centitled\u201d them to access to the state-backed<\/span><\/p>\n

Registration was open for six days, and <\/span>closed on 23 February<\/span><\/a>. After this, officials announced that soon a separate registration process would begin for individuals to receive state-backed VPNs. However such a promise never fully materialised and on <\/span>16 June 2013<\/span><\/a> Mehdi Khodayi, the Head of Public Relations at the Telecommunication Infrastructure Company (TIC) announced that 70 organisations have already received their legal VPNs.\u00a0<\/span><\/p>\n

Only days later, on <\/span>22 June 2013 <\/span><\/a>\u00a0the then Head of the TIC, Mahmoud Khosravi\u00a0 announced that despite spending \u201cmillions\u201dy, only 26 companies had registered \u2013 contradicting the earlier statistics. As a result, the TIC announced that the scheme was ending, and that \u201clegal VPNs for individuals\u201d would not be rolled out \u2013 the promise of opening registration to the general public never materialised. However, Iranian officials continued to insist that companies and organisations that needed to bypass internet filtering could apply for a licence, and receive permission to do so. However, since then, no attempt has been made to broaden access to these VPNs to the general public.\u00a0<\/span><\/p>\n

Current State of VPN Usage in Iran\u00a0<\/b><\/p>\n

According to <\/span>Iran\u2019s Cyber Police (FATA)<\/span><\/a>\u2019s own figures\u00a0 in October 2018 there were 10 to 12 millions VPN users in Iran \u2013 likely to be one of the highest percentages globally. There are three factors that have given rise to the prevalence of VPNs over the past decade:\u00a0<\/span><\/p>\n