{"id":3894,"date":"2022-09-14T12:51:28","date_gmt":"2022-09-14T12:51:28","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=3894"},"modified":"2022-10-11T19:40:14","modified_gmt":"2022-10-11T19:40:14","slug":"network-monitor-august-2022","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2022\/09\/14\/network-monitor-august-2022\/","title":{"rendered":"Network Monitor: Iran\u2019s Information Controls Targets Instagram With Major Disruptions"},"content":{"rendered":"

During the month of August, the Filterwatch team learned of a sharp drop in Instagram traffic coming from Iran. This comes at a time when Iranian authorities are rolling out a host of new information control policies and are interfering with internationally-based applications. The Filterwatch team investigated this issue to better understand the technical causes and policy rationale behind the reduced traffic.<\/p>\n

Based on our initial analysis and data obtained from OONI<\/a> test results, we believe that\u00a0 Instagram has become a main target of Iran\u2019s censorship regime. This comes as no surprise given Instagram\u2019s soaring popularity among Iranians and, until recently, it was one of the only uncensored foreign social media platforms in Iran. Rather than outright blocking the platform, authorities have blamed technical issues<\/a> in the Telecommunication Infrastructure Company (TIC)\u2019s LCT (Large Capacity Tandem) building for the heavy disruptions, which have made Instagram virtually inaccessible at times. TIC is effectively a subsidiary of the government and the LCT building has been responsible in the past for disrupting the internet among Iran\u2019s internet providers and other companies. Earlier this year in March, electric issues led to a fire<\/a> in the very same building.<\/p>\n

From a policy perspective, Instagram\u2019s disruption resembles what happened to WhatsApp, Psiphon, Google Outline, and others. In June<\/a> Iranian authorities appeared to attack the encryption protocols of popular international circumvention tools, including Psiphon and Google Outline making it difficult for Iranian end users to access the internet using these methods. At the same time, authorities appear to be hijacking the DNS of the Google Search engine to set Google Safe Search as a default feature for all users. WhatsApp experienced disruptions during this same period making voice calls impossible. Eventually the disruption stopped in late July for reasons Miaan cannot confirm. Miaan believes that authorities have taken these actions to set the stage for two emerging information control policies: \u201clegal VPNs<\/a>\u201d and an internet \u201cappropriate\u201d for children. The Children\u2019s Internet, as it has been dubbed, was initiated by a resolution of the Supreme Council of Cyberspace (SCC) and aims to create SIM cards that provide curated access to content based on age and gender.<\/p>\n

Currently, TIC is targeting only some Instagram addresses and SSL\/TLS connections.<\/p>\n

\"TIC<\/p>\n

They also dropped Instagram packets at the TIC level.<\/p>\n

\"Daropped<\/p>\n

TIC is targeting these addresses but not all at the same time, likely because authorities want to majorly disrupt Instagram without fully blocking it. Based on our observations, we believe that authorities aim to frustrate users into eventually abandoning the platform rather than outright banning it. Previous instances of heavy instagram disruptions resulted in public outcry and this will likely happen again. Given Instagram\u2019s popularity in Iran, a ban could be politically costly.<\/p>\n

Furthermore, these ongoing disruptions closely mirror disruptions that Viber<\/a> experienced a few years ago. It was a very popular messaging app among Iranians but authorities essentially made it unusable<\/a> without fully blocking it. As a result, Iranians were eventually discouraged from using it and Viber grew obsolete at essentially no political cost.<\/p>\n

The targeted Instagram addresses include:<\/p>\n

    \n
  1. instagram.com<\/li>\n
  2. i.instagram.com<\/li>\n
  3. static.cdninstagram.com<\/li>\n
  4. scontent-ams4-1.cdninstagram.com<\/li>\n
  5. static.xx.fbcdn.net<\/li>\n
  6. edge-chat.instagram.com<\/li>\n
  7. scontent-vie1-1.cdninstagram.com<\/li>\n
  8. scontent.cdninstagram.com<\/li>\n
  9. graph.instagram.com<\/li>\n
  10. instagram.fpnq1-1.fna.fbcdn.net<\/li>\n
  11. instagram.fsvg2-1.fna.fbcdn.net<\/li>\n
  12. connect.facebook.net<\/li>\n
  13. scontent-cdg2-1.cdninstagram.com<\/li>\n
  14. instagram.fdtm1-1.fna.fbcdn.net<\/li>\n<\/ol>\n

    Finally, authorities are also blocking text messages from Instagram and WhatsApp (as well as Twitter and Telegram) that send codes for the purposes of verifying a phone number during application installation and setup. Any text message that contains \u201ccode\u201d<\/i> or \u201cxxxxx is your Instagram code. Don't share it.\u201d<\/i> won\u2019t deliver. As you can see in the following screenshot, even when the user sends this kind of text to themself, they don\u2019t receive the text message.<\/p>\n

    \"Authorities<\/p>\n

    All these issues create challenges in terms of both access and security as they prevent the safe setup of relatively secure, international messaging platforms. It is possible that two factor authentication codes are facing the same issues.<\/p>\n

    Local digital rights activists put together an effective campaign criticizing the interference with Instagram and the multi-platform blocking of text messaging. Iranian officials and telecommunication companies responded by denying<\/a> that they blocked text messages or disrupted Instagram traffic. They are blaming Meta and other international tech firms for this\u00a0 issue.<\/p>\n

    Timeline of Regional Disruptions<\/h1>\n

    NOTE:\u00a0 In some cases the available data allows Filterwatch to determine if the disruption is a type of shutdown of access or throttling (i.e., a dramatic slowing of connection speeds). In other cases we can just observe a disruption or outage of some kind without more specificity. <\/i>Overall, our existing tools are not always able to accurately identify and fully examine the nature and scale of disruptions to Iran\u2019s domestic internet connections.\u00a0<\/i><\/p>\n

    \"\"<\/p>\n

    \"\"<\/p>\n

    Timeline of internet outages based on regions and cities:<\/p>\n