The tragic death of Jhina (Mahsa) Amini due to beatings while in the custody of Iran’s morality police precipitated a massive popular uprising in the country in September 2022. Protests spread across Iran, encompassing more than 140 cities. Despite ebbs and flows in the intensity of the movement, it continues today—in the form of protests in front of prisons, weekly protests after Friday prayers in Sistan and Baluchestan Province, and other actions.
While domestic protests against the Islamic Republic of Iran are not new, the Mahsa Amini protests—sometimes known as the “woman, life, freedom revolution”—have caused the regime to mobilize two decades worth of investment, development, and planning on information and internet controls. Iranian authorities are aggressively changing their digital repression strategy in ways that will reshape the next decade of information and communications in Iran.
New techniques of digital repression came to the fore in November 2019, before the latest movement, when Iranian authorities imposed a near total internet shutdown for almost a week. This allowed authorities to slaughter hundreds, if not thousands, of protesters in the darkness of an internet blackout. At that time, the regime tried to roll out a national internet network, sometimes known as an “intranet” or the National Information Network, while it shuttered access to the global internet. But it encountered many problems and glitches. In the end, the Internet Society estimated that Iran lost $33 million due to the shutdown.
Mahsa Alimardani has been working within civil society for over a decade on projects related to access to the internet, especially in Iran. She is a senior researcher with the international freedom of expression organization ARTICLE19, working on digital rights within the Middle East and North Africa region. She is also a PhD candidate at the University of Oxford’s Oxford Internet Institute, where she is finishing a thesis on Iran’s internet controls.
Ever since, the authorities have sought to finesse their tactics of digital repression to become more efficient, in particular by advancing the earlier mentioned nationalization efforts and attempting to pass the User Protection Bill, or Tarh-e Sianat. Multiple goals underpin these efforts: to build Iran’s information and communication technology industry, especially in light of international sanctions; centralize control of data and surveillance to serve state interests; and create a resilient system that can withstand temporary interruptions (such as those caused by protests) or long-term disconnections from the global internet.
While the focus of the nationalization effort had always been to move users onto national and controlled internet services and infrastructure, the User Protection Bill has been a more subtle effort to shepherd these ideas into policy. The bill’s main focus is to regulate and move users onto national platforms using techniques such as disabling VPNs and criminalizing VPN sales and usage. Research and monitoring show that this effort to develop technology to disable VPNs has been long in the making by various government authorities.
Since September 2022, the government has implemented several mechanisms to curb protesters’ use of the internet. One of these methods is to disable VPNs.
In Iran, where most independent internet services are censored, VPNs are synonymous with access to the internet. Recognizing this, Iranian authorities have long worked to advance their ability to disable VPNs, as tracked by the international human rights organization ARTICLE19. This has included the use of deep packet inspection technology and other means to disable circumvention tools. At the start of the protests, authorities added the most used applications in Iran—Instagram and WhatsApp—to the long list of censored platforms. Authorities also blocked the Google and Apple app stores. The Apple app store was eventually reopened, but the Google store continues to be blocked. More than 90 percent of Iranians use Google’s Android phones, and the majority use their phones to access the internet. With this crucial app store for Android users blocked, finding secure and functioning VPNs has been a further hurdle to access to the internet.
While the intensity of the protests has diminished since late 2022, Iranians’ quest for a stable circumvention tool continues. The top concern for Iranians who are still connected to the internet and one of the main points of research and development for the internet freedom community is to find ways to blunt the sophisticated techniques deployed by the regime to disable circumvention technology.
One of the hallmarks of Iran’s digital repression during the past year has been the implementation of internet shutdowns, particularly severe disruptions to mobile internet connections.
Since November 2019, authorities have increasingly used mobile shutdowns, especially in response to regional protests that started in 2021 in provinces such as Khuzestan, Kurdistan, and Sistan and Baluchestan. Mobile shutdowns have become favored methods of the regime because most users, particularly those in impoverished communities, rely on smartphones for connectivity. (In outlying provinces, the government has not invested in landline communications, making home broadband connections rare or nonexistent.)
Authorities have disabled mobile internet connections on most days since the protests began. Curfews have meant that mobile internet providers have been unusable, if not completely throttled, from 4:00 p.m. to 1:00 a.m. on major mobile carriers, such as Irancell, Rightel, and Hamrah Aval (MCI), across the country. In addition, home broadband connections have experienced extreme throttling and disruptions when protests have surged.
In many instances, the cities with the harshest internet shutdowns have also suffered extreme forms of brutality from authorities, such as the cities of Zahedan, Sanandaj, and Saqqez, which are all populated by Iran’s persecuted Kurdish and Baluch ethnic minorities. The greatest concentration of casualties during the protests occurred in Zahedan, which experienced what is now known as the Bloody Friday massacre of September 30, 2022, where at least 100 individuals were killed. Protests following Friday prayers have continued in Zahedan; these demonstrations have been accompanied by severe internet disruptions.
While access to the internet remains a major concern, Iranians are still finding ways to vocalize dissent online. In response, Iranian authorities are exploring and starting to apply newer methods of digital repression, including tactics that rely on fear and/or flooding. As scholar Margaret Roberts explains in the book Censored: Distraction and Diversion Inside China’s Great Firewall, authorities implementing information controls online around the world use “fear and/or flooding” techniques to intimidate demonstrators, as well as curb and distract dissent both online and offline.
Iranian authorities have pursued traditional repression tactics to stop protests, including killing at least 500 protesters, arresting over 19,000 individuals, and blinding, torturing, and raping individuals. This has often been sufficient to stop people from taking to the streets or to prompt parents to forbid their children from joining protests. However, government officials have augmented these efforts with digital tactics. These have included flooding online spaces with disinformation to distract or break unity in the opposition or using propaganda to induce fear. An example is the posting of videos on Telegram of forced confessions and torture. This raises concerns about platform accountability and whether companies will take down such content, especially considering companies’ revised policies for Russia that ban state propaganda following the Ukraine invasion. At times, overtly harmful content has been removed from Meta’s platforms and sometimes even on X, formerly known as Twitter. However, the proliferation of dangerous messaging on Telegram, where Islamic Revolutionary Guard Corps (IRGC) content thrives, has continued unabated.
The regime also floods the information space with false or bad information to stymie or prevent citizen mobilization. One particularly egregious case occurred in January 2023. As the government began carrying out executions of demonstrators, protesters in turn started mobilizing outside of prisons. In January 2023, there was widespread mobilization against the potential executions of Mohammad Mehdi Karami and Mohammad Hosseini, both of whom had delivered forced confessions about the murder of a security force member. People protested almost every day outside Karaj prison, where Karami and Hosseini were held, hoping to prevent their deaths. As news spread about the state’s final decision to execute them, one particularly insidious rumor captivated the attention of Iranians: the alleged assassination of Judge Abolqasem Salavati. Salavati is known to most Iranians as the “hanging judge” because of the hundreds of executions and lengthy prison sentences he has given to political prisoners, human rights activists, and media workers. He is among the most notorious perpetrators of human rights crimes in contemporary Iran.
The source of the news about Salavati’s reported death was an anonymous Twitter account known as “Jupiter rad” with over 100,000 followers at that time and a reputation for being an anonymous opposition activist. (The account was suspended in June 2023.) The rumor quickly overtook Persian language social media. In the meantime, Iranian officials quietly conducted the two executions with few protests outside the prisons. While attribution is not certain without further data, many believe Jupiter rad is a “cyberi” account—that is, a troll account run by the regime pretending to be a member of the opposition that is used to distract the public from state executions.
Another flooding tactic by the state has been the hacking of diaspora opposition members’ private information. The Telegram account of the Adl Aali hacking group has leaked stolen data and documents from the accounts of prominent opposition members in the diaspora, including Masih Alinejad, Nazanin Boniadi, and Reza Pahlavi. The group claims to have been able to access and hack all three of these individuals. The nature of the content they have released from the alleged hacks from Masih Alinejad indicate that some of the content and private videos of her were taken from her brother’s phone, who was held in an IRGC prison in Iran. While some documents from a brief hack of Alinejad’s Gmail account in 2019 have surfaced, the content from her brother’s phone has allowed ARTICLE19 to pin attribution to the IRGC. (The report will be published in November 2023). Adl Aali used its Telegram account to disseminate defamatory stories about each of the three people at the height of their efforts to coalesce opposition efforts into one “unity coalition.” While Telegram has removed some of the criminal content after reports and requests from civil society and victims, the company only acted on removals once the information and content had already spread to the information space.
The concept of “shonood”—living under authoritarian governance—is a norm in the everyday lives of Iranians that stretches back decades, if not centuries. The regime continues to develop multifaceted surveillance and monitoring tactics as part of its toolkit of digital repression. Certain elements of the regime’s surveillance systems have been hidden, only exposed through leaks and investigations, such as the mobile surveillance system of SIAM, a web program for remotely manipulating cellular connections made available to the Iranian Communications Regulatory Authority. Leaks from mobile internet service providers reveal that operators such as Ariantel are using SIAM to target users to throttle their internet access as well as monitor them. These efforts are part of a broader series of tactics to identify and arrest protesters.
An alarming development has been government exploitation of private tech platforms, such as the Iranian version of Uber and Uber Eats. Authorities have forced companies to share user data and geolocation information with security agents, leading to the arrests of protesters and activists. The integration of private technology with state repression adds further fuel to the situation.
The full extent of the government’s use of AI and facial recognition remains unknown. Various officials, including in the Ministry of Interior, have made announcements about using biometric technologies based on AI and facial recognition to identify women and girls who are not abiding by compulsory veiling laws. There have been documented instances of women being notified through text messages of infractions detected by traffic surveillance cameras while they were sitting in their cars. These developments have been exacerbated by the passing of the “Hijab and Chastity Bill” in September 2023, which further criminalizes women for not wearing hijab or promoting protests against mandatory hijab.
Despite these tactics, defiance remains high, and there is a possibility of a backfire effect from surveillance. As one contact in Iran said to the author in March 2023, “Women are fearless, and these announcements of AI surveillance policing our hijabs is meant to bring back the pre-Mahsa Amini obedience which we refuse to go back to.”
There are indications that authorities have acquired Chinese technology, such as Tiandy’s traffic surveillance system, to monitor women and protests, raising fears about transnational authoritarian flows of digital repression. However, when it comes to policing women and enforcing obedience to mandatory hijab laws, the most effective routes have been to use fear, penalize women in their workplaces or educational institutions for not following the regime’s rules, or shutter businesses that do not force their women employees to conform to strict codes of behavior and dress. While Iran’s AI and facial recognition surveillance capabilities are improving, the technology’s biggest advantage is not its actual capabilities, but rather its ability to intimidate women into obedience.
In response to the Mahsa Amini protests, Iranian authorities have implemented extensive internet and communications controls. These involve methods already known in the country, as well as new methods including tactics of censorship that utilize technologies to block circumvention tools and mobile and regional internet shutdowns. The authorities are also experimenting with technologies intended to stop protests by creating fear and intimidating the populace. These approaches of controlling and manipulating the digital sphere are intended to deter any form of dissent against the forty-four-year brutality of the Islamic Republic. Iranian authorities are not only setting the stage for continued repression of domestic activists, but they are also borrowing from and contributing to global tactics for digital repression.
Carnegie does not take institutional positions on public policy issues; the views represented herein are those of the author(s) and do not necessarily reflect the views of Carnegie, its staff, or its trustees.