Internet penetration, bandwidth, and speeds have increased markedly in recent years due to increased government investment in information and communication technologies (ICTs).

As of January 2022, internet penetration stood at approximately 84.1 percent.1 The Communications Regulatory Authority (CRA) reported that the mobile internet penetration rate stood at 109.27 percent at the end of 2021.2 The median mobile and broadband download speeds were 26.10 and 10.34 megabits per second (Mbps), respectively, as of May 2022.3 According to the Inclusive Internet Index, Iran ranks 45th out of 100 countries surveyed due to "web accessibility and government efforts to improve” fifth-generation (5G) technology for mobile networks.4

In February 2020, the Supreme Council for Cyberspace (SCC), Iran’s top internet policymaking body, began dedicated meetings to set five-year targets for the expansion of the National Information Network (NIN)—the country’s localized internet architecture—which was approved in September 2020 (see A3).5 Some of the targets relating to connectivity included: mobile internet access to be provided for 100 percent of the population with an average speed of 10 Mbps; broadband internet access to be provided for 80 percent of households with an average speed of 25 Mbps; internet speed for businesses to increase to 100 Mbps; and the creation of conditions to connect at least 10 percent of users to the next generation of telecommunications technology.6

Several NIN-related infrastructure projects and investments have been announced in recent years, demonstrating that, despite the straining economy,7 authorities remain committed to developing the network. In 2021, several 5G mobile networks were launched in cities, including Tehran and Mashhad.8

In December 2021, the head of the Information and Communications Technology (ICT) Ministry of Iran (ICT), Eisa Zarepour, appeared in the Majles (Parliament) and announced ambitions for infrastructural expansion and investment in fiber-optic cable capacity, while noting that the development of the NIN remains the highest priority for the ministry.9

The creation of a new working group dedicated to satellite-based internet service at the National Center for Cyberspace (NCC) was announced in February 2021, though such a service is not yet available for at-home use in Iran.10

The government’s investment in ICT infrastructure through the NIN has increased connectivity in rural areas, making some reductions in the urban-rural divide, though pricing remains high. The CRA has implemented measures to extend access to rural areas and decrease prices for users.

Despite complaints of slow internet speeds from users, which especially affected those connecting to the global internet, prices increased during the coverage period. In April 2022, Iranian ISPs increased their prices between 60 and 100 percent, with some mobile operators also scraping their 6- and 12-month subscriptions in favor of more expensive 90-day packages.11 According to the Inclusive Internet Index, Iran ranks 66th for internet affordability.12 The monthly cost of an 8 megabyte (MB) internet package costs 688,850 rials ($16).13 For comparison, Iran’s gross national income (GNI) per capita was $15,760 in 2020, according to the World Bank.14

A bandwidth pricing policy was implemented in 2017 which prices internationally routed traffic—downloads or uploads of global internet content—at a higher rate than domestically hosted websites (through the NIN) and other government-approved content (see B7).15 This policy also discourages the use of virtual private networks (VPN)s by making them more expensive.16

Despite overall improvements to access, inequalities persist. Specifically, some rural provinces on the border, which are often inhabited by ethnic minorities, have poorer access than urban areas. During the COVID-19 pandemic, this digital divide became clearer, particularly for young people in internet-deprived regions of Iran who faced difficulties accessing the online education content – including the Iranian education app Shad – due to a lack of access to the internet or electronic devices.17

In February 2021, the parliament approved a 10 percent tax increase for ISPs, to be included in the draft budget for the following year.18 Former ICT minister Mohammad Javad Azari-Jahromi commented that the new measure would cause a “significant increase” in internet package prices. It was later announced that the increase would take effect for telecommunications companies and ISPs when they next renewed their licenses.19

Score Change: The score declined from 2 to 1 because authorities conducted multiple localized internet shutdowns, often around protests, during the coverage period.

Multiple network disruptions and localized internet shutdowns took place over the course of the reporting period. Localized internet shutdowns are often used to immobilize protests and prevent accurate reporting on demonstrations, to which authorities often respond with unjust force and violence (see B8). Furthermore, Iran’s internet backbone is highly centralized, which allows authorities to restrict connectivity.

Localized and extensive internet disruptions were reported in Khuzestan province in July20 and November 202121 and May 2022,22 as well as in Isfahan in November 2021.23 Authorities throttled or shut down internet service for various lengths of time—a few days in November 2021, but a week in July 2021—in response to protests over chronic water shortages. The disruptions were focused mostly on mobile internet connections and were especially pronounced in areas where protests were taking place, though in July 2021 some domestic services remained available via the NIN. In all instances security forces intervened violently, resulting in protesters being injured, arrested, or in some cases, killed: 24 According to the Centre for Human Rights in Iran, at least five protesters were killed in May 2022; 25 214 people were arrested and dozens were injured in November 2021; 26 and in July 2021, 6 people were killed, dozens were injured, and hundreds were arrested after live ammunition was used against the unarmed demonstrators.27

In September 2022, after the coverage period, authorities implemented multiple internet shutdowns and mobile disruptions, both localized and more widespread, in an effort to quell massive antigovernment protests.28 Protesters took to the streets following the death of Mahsa Amini, a 22-year-old ethnic Kurd who was arrested by the morality police in Tehran for wearing “improper hijab.”29 While Iranian authorities have denied misconduct, Amini was reportedly beaten during her transfer to the police station. In addition to disrupting internet and mobile services, authorities also blocked access to WhatsApp and Instagram (see B1 and B8).30 Security forces, meanwhile, have arrested, injured, and killed protesters as they crack down on the demonstrations; as many as 201 people have been killed at the hands of security officers as of mid-October.31

While no major internet disruptions were observed during the June 2021 presidential elections, a localized mobile internet shutdown was implemented by authorities two days later in the city of Yasuj, the provincial capital of Kohgiluyeh and Boyer-Ahmad province.32 Limited information has been available about the shutdown, especially as localized shutdowns are difficult to detect via network measurement tools, however the shutdown was reportedly in response to clashes following city council elections. Internet connectivity was restored the next day.

Similar localized internet shutdowns were reported in previous coverage periods. In February 2021, authorities disrupted internet connectivity for three days in Sistan and Baluchestan when 10 people were killed and 5 people were injured during protests over security forces’ violent clashes with fuel traders in the city of Saravan.33 Though broadband connections remained in place during this time, the disruption was effectively comprehensive, as over 95 percent of users in the province rely on mobile internet. In July 2020, mobile internet connections were cut off in specific neighborhoods in Khuzestan Province, where protests were taking place.34 Officials did not publicly acknowledge the shutdown. Later that month, network disruptions were reported across Iran for about three hours as users shared hashtags on social media to speak out against death sentences handed down to three men who participated in the 2019 protests (see B8).35

The nationwide near-total internet shutdown imposed in November 2019 lasted for at least seven days and affected both mobile and broadband connections across most of the country. The decision to disconnect the country from the global internet was made by the National Security Council following a wave of protests sparked by the sudden announcement of a significant increase in fuel prices.36 No prior notice was given to users, and no parliamentary approval was sought to extend the shutdown beyond its initial 24-hour period.37 The November 2019 internet shutdown remains the only nationwide shutdown in Iran to date. At least 304 people were killed by security forces during the protests, and thousands were arrested according to Amnesty International.38

In June 2021, the latest version of a bill aimed at further restricting Iran’s internet, commonly referred to as the “User Protection Bill,” returned to the parliamentary agenda. The bill is designed to restrict online content and tighten regulations on foreign and domestic online platforms (see B1, B2, C4, and C6). Furthermore, the bill calls for the country’s internet gateways to be controlled by a working group comprised of the armed forces, the Islamic Revolutionary Guard Corps’ (IRGC) intelligence agency, the Intelligence Ministry, the ICT Ministry, the judiciary, and the Passive Defense Organization.39 The bill had not passed by the end of the coverage period.

Through the NIN, authorities have demonstrated the ability to cut off connections to the global internet, while keeping domestic services online. During the coverage period, users reported sustained, slow speeds while connecting to the global internet. Specifically, users reported slowed speeds on Instagram, one of the few international platforms that was still accessible in Iran at the end of the coverage period. Several international social media and messaging platforms are blocked in Iran, such as Facebook, YouTube, Twitter, and Signal (see B1).

An Iranian technology news website has claimed that slow internet speeds are a result of the SCC deliberately hindering bandwidth to the global internet. According to the same report, the SCC has not issued the Telecommunication Infrastructure Company (TIC) with a license to increase their purchase of global bandwidth to meet the country’s demands since the arrival of president Ebrahim Raisi.40 The TIC retains a monopoly on internet traffic flowing in and out of the country.41

Various government bodies, including the ICT Ministry and the SCC, have denied these reports.42 However, this development is in line with a long-term policy of forcing Iranians onto domestic services and platforms and restricting the use of VPNs while the government works on rolling out its own approved VPN scheme (see B7).

The telecommunications industry is tightly controlled by the government. The TCI owns the Data and Communication Company (DCC), the country’s main ISP. The Mobile Telecommunication Company of Iran (MCI), a subsidiary of the TCI, is the largest mobile service provider.43

The second-largest mobile service provider, MTN Irancell, is owned by MTN and Iran Electronics Industries, a state-owned subsidiary of the Defense Ministry.44

The ICT Ministry has sought to capitalize on expanded bandwidth by promoting internet protocol television (IPTV) as a new avenue for media diversity.45 The Islamic Republic of Iran Broadcasting (IRIB)—the state broadcaster, whose head is appointed directly by the supreme leader— has fought these efforts and began issuing its own licenses in 2017.46 In January 2020, a notice signed by then chief justice Ebrahim Raisi was sent to regional judiciary officers, stating that the IRIB is responsible for issuing licenses and regulations relating to audio and video content online.47

The bodies that regulate the telecommunications sector lack independence. The SCC, which sets most policies related to the internet, was established through a 2012 decree by the supreme leader and is composed of 17 representatives from government institutions and 10 members appointed by the supreme leader.48 It is intended to provide a centralized point for policymaking and the regulation of Iran’s virtual space, effectively minimizing the roles of the executive, legislative, and judicial branches and bringing internet policy under the supreme leader’s direct control.

The CRA, which falls under the ICT Ministry, is responsible for telecommunications licensing. Its head is appointed by the ICT minister.49

In the past, government officials routinely criticized the SCC for being disorganized,50 and for neglecting to encourage Iranians to use the internet in a “clean” and Islamic fashion.51 However, during former president Hassan Rouhani’s second term in office, and since the arrival of Raisi as president in August 2021, the SCC has held meetings more frequently.

Authorities restrict access to thousands of websites, particularly those of international news and information services,52 the political opposition, ethnic and religious minority groups in Iran, and human rights organizations.53 Websites are also blocked if they contradict state doctrine regarding Islam or government narratives on domestic or international politics. News stories that cover friction between Iranian political institutions are frequently censored. Many Iranians rely on VPNs to access international services and content blocked by authorities.

Article 749 of the penal code requires all ISPs to filter any content determined by the Commission to Determine the Instances of Criminal Content (CDICC)—a government body headed by the prosecutor general that consists of representatives from 12 state institutions—to be criminal content. Resistance in complying with this article can result in the termination of the ISP or in some cases a financial penalty.54

Twitter, Facebook, Telegram, and YouTube are all blocked or filtered, as are major blog-hosting platforms like Wix, WordPress, Blogspot, and Blogger.55 The navigation app Waze and the messaging app Viber, which were developed in Israel, were first blocked in 2017 and 2014, respectively.56 In April 2018, a prosecutor in the Media Court issued an order to filter Telegram, resulting in the obstruction of the platform by ISPs and mobile service providers.57 The messaging app Signal was blocked in January 2021.58 In April 2021, the audio discussion app Clubhouse, which had quickly gained popularity among Iranian journalists, politicians, state elites, and activists, was blocked by Iranian providers.59 Officials failed to take responsibility for the decision. In May 2021, ahead of the presidential election, a leaked letter from the judiciary indicated that authorities had planned to filter Instagram, Google Play, and several VPN services, as calls to boycott the upcoming vote mounted on social media.60 However, the order was allegedly revoked shortly after being issued.

Despite calls to block Instagram, the platform remained accessible at the end of the coverage period. However, both Instagram and WhatsApp were blocked, along with various other websites and platforms, amid antigovernment protests in September 2022, after the coverage period (see A3 and B8).61 Throughout 2021, users reported difficulties accessing Instagram due to the frequent throttling of international internet traffic (see A3).62 Iranian officials did not provide an explanation (see B3).63

Authorities continued to propose legislation that could censor international platforms and force Iranians onto domestic platforms. The latest version of the so-called “User Protection Bill” returned to the parliamentary agenda in June 2021 (see A3, B2, C4, and C6). The bill, which had not passed by the end of the coverage period, would require foreign and domestic online platforms to register with a supervisory board and comply with Iranian laws or face penalties, including blocking or throttling, or be replaced with “domestic alternatives.”64

LGBT+ content online is routinely blocked. A 2021 report on LGBT+ online censorship from the Open Observatory for Network Interference (OONI) found that 75 unique LGBT+ URLs have been blocked in Iran.65

Domestic news sites are frequently blocked for criticizing the government. In March 2022, the reformist outlet Emtedad news was blocked per a decision by the CDICC. According to some reports, the website did not have a license from the Culture Ministry,66 but the outlet’s chief editor claimed they had been given no prior notice about the action. Anar Press and Aban Press were blocked after the chief editor of both sites was arrested in April 2019.67

Following the February 2022 violent murder and beheading of a 17-year-old girl by her husband in the city of Ahvaz, a graphic video of the incident was shared online. The Audio-Visual Regulatory Authority (SATRA), which operates under the state broadcaster, the IRIB, issued a ban against visual content related to the murder.68 On the same day, Iran’s Press Supervisory Board seized the website for the news outlet, Rokna, for “publishing content contrary to public decency” following their reporting, and use of visual content, relating to the murder. The website was restored by the end of the coverage period.

Authorities employ a centralized filtering system that can effectively block a website within a few hours across the entire network. Private ISPs are forced to either use the bandwidth provided by the government or route traffic containing site-visit requests through government-issued filtering boxes developed by software companies within Iran. The filtering boxes inspect URL requests submitted by users for banned text strings—either keywords or domain names—and block access accordingly. This method only limits access to content retrieved through unencrypted Hypertext Transfer Protocol (HTTP) connections. Individual pages remain available over an encrypted connection (HTTPS), which disguises the banned text, requiring censors to block the entire site in order to restrict access to specific content.69

Authorities frequently employ administrative measures to force the removal of legitimate online content.

Website owners must register their sites with the Culture Ministry and are then subject to requests to remove posts deemed unacceptable by the government (see B6). The 2009 Computer Crimes Law (CCL) makes hosts such as blogging platforms responsible for any content that appears on their sites. This has led to the suspension of blogs and the shuttering of news sites hosted on platforms inside Iran.

Under an August 2019 order signed by the then deputy prosecutor general responsible for cyberspace, internet hosting companies inside the country are banned from providing services to filtered websites and can face prosecution for doing so.70 The affected sites include those carrying news and information about human rights or other politically relevant content, which are now forced to rely on international hosting companies or shut down entirely.

Authorities frequently request outlets to take down content, often providing no justification for the decisions. In November 2021, the CDICC ordered the removal of a poem dedicated to the victims of the November 2019 protests from Iranian websites.71 In May 2021, Aparat stated in a social media post that an interview with former Iranian president Mahmoud Ahmadinejad had been removed following an order from the IRIB though it did not state the reason.72 Following public backlash online, SATRA stated that the decision was “made in error.”

According to the British Broadcasting Corporation (BBC), two Persian language content moderators at Instagram claimed that they were offered bribes to delete the account of an Iranian American activist during the coverage period.73 According to one of the moderators, they were approached by Iranian intelligence officials and asked to delete the account of Masih Alinejad, who was said to be the subject of a kidnapping attempt by Iranian intelligence officials in 2021 (see C7). While Meta denied these claims, they came amid numerous reports of Iranian Instagram accounts and hashtags being removed during protests (see B5 and B7).

Content removals were common during the 2017 presidential election period. According to the Center for Human Rights in Iran, hours after the Rouhani campaign published a video in which reformist former president Mohammad Khatami declared his support for Rouhani’s reelection bid, campaign officials were told by the judiciary to delete the video from social media or face arrest.74

The IRGC routinely arrests Telegram group administrators to coerce them to remove content or delete their channels from the platform (see C3). The practice was prevalent in the months prior to the 2017 presidential election, when several reformist-aligned Telegram channels were either deleted or stopped publishing due to the arrests of their administrators.75

A bill most recently introduced in June 2021, commonly referred to as the “User Protection Bill,” would make foreign and domestic online platforms register with a regulatory body and comply with Iranian laws—including requests for content removal—or face penalties (see A3, B1, C4, and C6).76 The draft bill would further limit content available online and would make companies responsible for removing content deemed inappropriate under Iranian law. In March 2022, over 50 human rights organizations signed a statement to voice their concerns over the contents of the bill, which they said would “violate [Iranians’] right to privacy” as well as “freedom of expression and access to a secure and open Internet.” 77

The CDICC—a government body headed by the prosecutor general who convenes the commission’s meetings—consists of representatives from 12 state institutions, is responsible for making censorship decisions. These are often arbitrary and lack transparency. Other bodies, such as the judiciary, have also ordered filtering decisions, such as the ban on Telegram. Such decisions are ostensibly based on the 2009 CCL, which outlines a broad range of banned content, from insulting religious figures and government officials to distributing pornographic content and using illegal circumvention tools.78 State authorities have not taken responsibility for the 2021 blocking of Signal and Clubhouse, indicating that decisions on internet restrictions are becoming increasingly opaque.

In January 2019, two members of Parliament who sat on the CDICC wrote to the Parliament speaker to complain about the lack of regular commission meetings and question the legality of its attempts to hold online votes on the filtering of websites.79 The prosecutor general’s reluctance to call meetings may have stemmed from the fact that the ICT Ministry and its allies likely had enough votes to reject attempts to block certain sites.80

Restrictions on content and services linked to US sanctions sometimes lack transparency. In June 2021, the US government seized 33 websites said to be “used by the Iranian Islamic Radio and Television Union (IRTVU) and three websites operated by Kata’ib Hizballah (KH),” in violation of US sanctions.81 According to a statement by the US Justice Department, these organizations “targeted the United States with disinformation campaigns and malign influence operations.” However, the statement did not confirm the list of websites that were seized or how their seizure would combat these disinformation campaigns.

On the anniversary of the death of Iranian military leader Qasem Soleimani, some Iranian social media users and journalists had their Instagram posts about the event removed or had their accounts suspended, apparently in “compliance with US sanctions” (see B6).82 In January 2022, Instagram restricted the #IWillLightACandletoo hashtag used to remember the victims of the Ukraine International flight PS752 crash. According to Meta, Instagram’s parent company, the restriction was a “mistake” and was lifted around 24 hours later.83

The Iranian ICT Minister’s Instagram page was suspended in March 2022. Though no reason was given for the suspension, the account was restored within 24 hours.84

Self-censorship among journalists and other users is extensive, particularly regarding political issues.

The arrests, imprisonment, and other punishments and sanctioning of journalists, activists, and ordinary citizens in retaliation for their online activities, as well as perceptions of pervasive surveillance, contribute to self-censorship. Many journalists and bloggers abandoned their online activities or used pseudonyms after the crackdown on 2009 protests linked to that year’s disputed presidential election, resulting in a noticeable reduction in the amount of original content produced by users. Tight restrictions on journalism and online speech remain in place, and journalists continue to be prosecuted in connection with their work (see C3). In addition, the intimidation of content producers, particularly on Instagram, has caused a rise in self-censorship on social media platforms (see C7).

In September 2019, Sahar Khodayari, who later became known as “Blue Girl,” died after self-immolating following her prosecution for attempting to enter a sports stadium in violation of gender-segregation rules.85 Authorities limited reporting by state media around the event, which drew attention to violations of women’s rights in Iran (see B5). Parviz Parastui, a prominent Iranian actor, took to his Instagram page to voice his anger about Khodayari’s prosecution and corruption in the judiciary,86 but the post was removed a day later without explanation.

The state counters online criticism through an extensive digital propaganda apparatus.

The regime has backed numerous initiatives to promote blogging among its supporters and members of the Basij paramilitary group.87 For example, an Iranian cultural center has sponsored the annual National Cyber Jihad Festival for bloggers to promote conservative religious values online.88 Authorities also actively support the creation of state-sanctioned social networking sites and mobile apps by offering free bandwidth and hosting to local developers.89 Increasingly, extensive state-aligned cyberoperations spread disinformation and manipulate the online space both domestically and abroad.90 The IRGC similarly uses state-owned media to spread disinformation online, in part by regularly misrepresenting European and US commentators as supporters of Iran’s policies.91

Social media manipulation is common. In September 2021, Meta removed a network of fake accounts involved in a domestic influence operation, primarily targeting users in the Lorestan region. The network was linked to the IRGC and purchased fake followers to boost credibility.92 During the July 2021 protests and accompanying internet disruptions in Khuzestan province, a number of Twitter accounts used the hashtag “Khuzestan’s good news” in both Persian and English in an apparent coordinated campaign to disseminate disinformation about the protest conditions in the province.93 Also during this time, progovernment journalist Hossein Dalirian travelled to Khuzestan and took to Twitter—which is blocked for ordinary users in Iran—to deny internet disruptions in the province (see A3).94

According to BBC reporting, two Persian language content moderators at Instagram claimed that they were offered financial bribes by members of the Iranian intelligence service to delete the account of Iranian American activist, Masih Alinejad (see B2).95 Both content moderators also claimed that they observed “pro-regime bias” while reviewing Iranian content.

The newly popular audio-only app Clubhouse became popular during the coverage period, particularly in the run up to the 2021 presidential election. During this time government officials appeared on the platform, and in some cases, spread progovernment propaganda to advance their political interests.96

News sites and journalists are consistently warned against covering sensitive political or social topics, such as controversial former presidents like Khatami.97 Ahead of the June 2021 presidential election, a number of journalists received judicial warnings about election coverage, with some reporting harassment from the Cyber Police (FATA) and the IRGC’s cyberunit, according to the International Federation of Journalists.98 As the COVID-19 pandemic began to spread across Iran in 2020, Iran’s leadership was accused of downplaying the extent of the outbreak and underreporting the number of cases.99 Journalists were ordered to announce only official numbers provided by the Health Ministry.100

During the November 2019 protests and subsequent internet shutdown, journalists and media outlets were issued official guidelines from the Intelligence Ministry and the Culture and Islamic Guidance Ministry on how to cover the news.101 They were threatened with criminal prosecution if they strayed from the ministries’ instructions, which required outlets to downplay the protests and avoid making them into “headline news.” Journalists were directed to portray the demonstrations as civil protests or “turbulence,” without mentioning the extent or violence of security forces’ response.102

There are several regulatory and economic constraints that affect the ability of users to publish online. Domestic internet traffic is priced at a lower rate compared to international traffic, ending net-neutrality and making it more costly for users to access international platforms.

In addition, given the tighter economic sanctions associated with the US government’s “maximum pressure” campaign, many international tech companies have ceased offering their services to Iranian users.103 For example, Google does not allow online advertising in Iran due to sanctions,104 disadvantaging domestic outlets. Other companies, such as Samsung and the Apple are among several companies that have withdrawn services from Iran.105 Some Bitcoin sites have also withdrawn from the Iranian market.

Sanctions came into further focus during the November 2019 nationwide internet shutdown, as observers noted that the economic penalties had forced many Iranians to use domestic services—some of which remained available during the shutdown by using domestic infrastructure—making shutdowns of global internet access much less costly for authorities (see A3).106

In January 2021, the software development platform GitHub confirmed that it had secured a license from the US Office of Foreign Assets Control (OFAC) to resume services in Iran, after implementing restrictions in 2019.107 However, there has not been wider uptake by other international tech companies to offer services to Iranians.

By splitting domestic and international traffic, ending net-neutrality in the country, and creating price incentives for users to browse domestic content, Iran has created barriers to media diversity and innovation (see B6).108

Instagram is often used as a news source, a platform for activism, or to discuss politics.109 Aparat, an Iranian website similar to YouTube that enjoys less expensive tariff rates, is one of the most visited websites in Iran.110 Content on Aparat is governed in accordance with Iranian law, making it difficult for users to share or access socially or politically sensitive views. Internet hosting companies inside the country are banned from providing services to filtered websites under threat of prosecution (see B2).111

VPNs are commonly used to protect online privacy and to circumvent the government’s filtering; their availability has been a topic of debate among politicians for some time. In May 2019, the head of the circumvention provider Psiphon claimed that between one and two million people in Iran used its service daily.112 However, the government regularly seeks to disrupt access to VPNs and has also made efforts to establish a “legal VPN” scheme to control access to the tools.

SCC secretary Abolhassan Firouzabadi announced that the CDICC had drafted a regulation for creating “legal VPNs” and had assigned the technical aspect of the plan to the ICT Ministry, and that the scheme was to be followed up in 2022. It is expected that individuals will have to apply to purchase VPNs and secure approval from the government based on their need. Users may need to submit proof of their profession in order to gain access to the global internet.113 The “legal VPN” scheme had not been implemented by the end of the coverage period.

Online diversity is severely restricted by extensive website blocking and financial constraints. In addition to government policies, US sanctions have forced some international platforms to cease offering services in Iran, which has forced users onto less secure domestic platforms where authorities can tightly control the available content (see B6).114 Nearly all international news websites are blocked, as are websites that host content about LGBT+ rights and religious minorities (see B1).115

Despite formal blocks on Facebook, Twitter, YouTube, and other international services, social media platforms play an important role in allowing dissidents to pursue online campaigns and share information. Instagram, which was available at the end of the coverage period, is a popular communication tool for activists.

Bandwidth throttling and internet shutdowns are common during politically sensitive times and used to crush protests and demonstrations and to disrupt the documentation of human rights violations.116 A nationwide internet shutdown was implemented during the November 2019 fuel-price protests and numerous localized internet shutdowns were reported during protests throughout the coverage period (see A3).

Government authorities have arrested social media users because of their participation in online mobilization initiatives. In July 2022, after the coverage period, women in Iran took to social media to protest the country’s strict hijab laws by posting videos of them taking off their hijabs. During this time an activist was arrested after participating in the “no to mandatory hijab” social media campaign (see C3).117 In September 2022, after the coverage period, authorities disrupted internet and mobile services and blocked access to WhatsApp and Instagram amid massive antigovernment protests, during which some women took off their headscarves in support of Mahsa Amini (see A3 and B1).118

In July 2020, an Iranian court approved the request for a retrial of three men who were sentenced to death due to their participation in antigovernment protests. The court’s decision followed an online hashtag campaign against the executions. The hashtag “#do_not_execute” was shared more than seven million times online.119

In August 2020, Iranian women used Twitter to share their stories of sexual violence and denounce the harassment and abuse they suffered, with some using the hashtag #MeToo, which had become popular in 2017. Many women chose to use pseudonyms online, but some journalists contributed under their real names. The #MeToo movement in Iran has elicited mounting support on social media and offline. Specifically, lawyers have offered pro bono legal advice, anticipating that in the Iranian context, the accusers could face repercussions for speaking out.120

Social media are also employed to engage in political debates. Ahead of the June 2021 presidential election, Iranians used the platforms to call for a voter boycott,121 and candidates campaigned on Clubhouse.122 Even conservative candidates who had once railed against social media used such platforms, reflecting their political importance in Iran (see B5).123

In addition to government actions, international platforms’ content moderation policies have also impacted online movements in Iran (see B3). In January 2022, Instagram restricted the hashtag “#IWillLightACandletoo” in both English and Persian, which was used to remember the victims of the Ukraine International flight PS752 that was shot down by the IRGC in 2020. According to Meta, the restriction was a “mistake” and was lifted around 24 hours later.124 During protests in Khuzestan province in July 2021, Instagram users reported that their posts were being removed for “breaching community guidelines.”125 In May 2022, Instagram users reported content relating to protests being removed by the platform. These removals also affected the accounts of the London-based Persian news channel Iran International and the popular account 1500Tasvir.126

The constitution and legal framework do not protect freedom of expression and press freedom online. The head of the judiciary is appointed by the supreme leader, Ali Khamenei, and the courts in general lack independence.

In July 2021, Khamenei appointed deputy judiciary chief Gholam-Hossein Mohseni-Ejei to lead the judiciary, after the former head, Ebrahim Raisi, was elected to the presidency in June.127 Raisi’s past role as a member of Tehran’s “death commission,” responsible for the executions of thousands of political prisoners in 1988, stoked strong opposition to his appointment from international human rights groups.128

The constitution provides for limited freedom of opinion and expression, but a variety of haphazardly enforced statutes limit these rights in practice. In 2016, then-president Rouhani launched the Citizens’ Rights Charter,129 a nonbinding document that includes commitments to freedoms of speech and expression “within the limits prescribed by the law.”130

Numerous laws tightly restrict online speech and allow harsh punishments for those who deliberately flout the constraints or inadvertently draw the ire of authorities. The 2000 Press Law, for example, forbids the publication of ideas that are contrary to Islamic principles or detrimental to public rights, none of which are clearly defined. The government and judiciary regularly invoke this and other vaguely worded legislation to criminalize offline and online criticism of the regime.

The 2009/10 Computer Crimes Law (CCL) outlines punishments for spying, hacking, piracy, phishing, libel, and publishing materials deemed to damage “public morality” or result in the “dissemination of lies.”131 Punishments are severe and include the death penalty for offenses against public morality and chastity, as well as long prison sentences, draconian fines, and other penalties for service providers that fail to enforce government content restrictions.132 The repressive penal code also applies to online activities.133

A motion put forth by Iranian members of Parliament in March 2021 seeks to amend the Satellite Equipment Prohibition Law, which would criminalize content produced and published on “unauthorized platforms.”134 These unauthorized platforms are most likely to include international platforms such as YouTube, Twitter, and Instagram.

FATA has launched a major crackdown on online gambling and has arrested online users for both the promotion of online gambling as well as for administering such websites and content.135

The new resolution, “Document on Preventing and Combating the Dissemination of Misinformation and Fake News and Content,” ratified by the SCC in January 2021, seeks to establish a legal framework in collaboration with a number of ministries and the judiciary to address what it refers to as “fake news” in online spaces.136 Its scope could also encourage more self-censorship by the press and others inside Iran who wish to avoid prosecution (see B4).

In September 2022, after the coverage period, the IRGC called for the prosecution of those who spread “false news and rumors” amid massive antigovernment protests.137

Score Change: The score increased from 0 to 1 because no long prison sentences were handed out during the coverage period due to content published online, although users were still arrested and sentenced to shorter prison terms.

The authorities routinely arrest and impose harsh sentences on journalists and social media users for their online activities. Those affected in recent years have included prominent activists, Instagram celebrities, editors at independent news outlets, and citizen journalists associated with persecuted religious groups like the Gonabadi dervishes and Baha’is.138

Activists, journalists, and social media users were arrested for their online content during the coverage period. In November 2021, human rights defender Narges Mohammadi was sentenced to 36 months in prison, a fine, and 80 lashes on charges of “anti-government propaganda by means of the publication of false information” and “insulting government officials.” Mohammadi frequently speaks out about human rights abuses in Iran online and via social media.139

In November 2021, photojournalist Rahil Mousavi was arrested in Khuzestan province after she posted about climate change issues and the struggles of Iranian Arabs on her Instagram account. Her current location and the charges against her remained unclear at the end of the coverage period.140

Blogger Seyed Hossein Ronaghi Maleki was arrested in February 2022 after he criticized the “User Protection Bill” on his Twitter account.141 According to his brother, Ronaghi Maleki began a hunger strike shortly after his arrest (see C7). He was released on bail from Evin Prison in Tehran in March 2022.142

Farideh Moradkhani, the niece of Iran’s supreme leader, was arrested in January 2022 and some of her personal belongings were reportedly confiscated. Her arrest came following a video of Moradkhani speaking at an online birthday celebration for Farah Pahlavi, the widow of the last shah of Iran.143 The details of her arrest and the charges against her are unknown as of the end of the coverage period.

In July 2022, after the coverage period, activist Soori Babaei Chegini was arrested after participating in a “no to mandatory hijab” social media campaign (see B8). According to reports, she was arrested after posting a video online showing her taking off her hijab in protest of the country’s strict hijab laws. Eight security agents allegedly raided her home, confiscated her cell phone, and threatened her children (see C7).144

In October 2020, the founder and manager of Iran’s domestic video-sharing platform Aparat, Mohammad Javad Shakuri Moghadam, was sentenced to 10 years in prison. Shakuri Moghadam was charged with “encouraging corruption” after a video was posted to Aparat that asked children if they knew how they were born. The video was removed an hour after it was posted.145

In October 2019, Ruhollah Zam, the France-based journalist and founder and administrator of the Telegram channel Amad News, a popular antigovernment news outlet with around 1.4 million subscribers, was arrested after allegedly being abducted from Iraq, and his Telegram channel was seized by the IRGC.146 The government had previously accused Amad News of inciting protests in 2017 and 2018, and of being affiliated with foreign intelligence services.147 Zam faced 17 charges, including spying and “collusion with the US government against the Islamic Republic of Iran.”148 In June 2020, he was found guilty of “corruption on earth,” was sentenced to death,149 and was executed by hanging on December 12, 2020.150

In August 2019, dozens of Instagram “influencers” with large online followings were summoned by FATA as part of a crackdown on online behavior deemed inappropriate by the authorities, such as women posting photos of themselves without the hijab or maintaining accounts focused on modeling and fashion shoots.151 Though some detainees were released on bail or received warnings, others were charged with posting “criminal content” and forced to hand over passwords and account details to the police, according to an investigation by the Center for Human Rights in Iran.

Following the crackdown, in April 2020, popular Instagram couple Ahmad Moin-Shirazi, a former world kickboxing champion also known as Picasso Moin, and his wife Shabnam Shahrokhi revealed that they had been sentenced in absentia on charges of “propaganda against the regime” and “spreading obscene and vulgar content” on social media.152 Shahrokhi was sentenced to seven years in prison, 74 lashes, and three months of community service, while Moin-Shirazi was sentenced to nine years in prison. The couple had fled to Turkey in September 2019 after harassment by the government and remain in exile.

During the November 2019 protests, journalist Mohammad Mosaed was arrested by security forces for posting on social media about the internet shutdown.153 He was also arrested and interrogated by the IRGC in February 2020 regarding posts in which he criticized the government’s response to the COVID-19 outbreak; he was forced to delete his Twitter and Telegram accounts.154 In September 2020, Mosaed was sentenced to four years and nine months in prison, as well as a two-year ban on journalism activities and use of all communication devices.155 He fled to Turkey in January 2021 and applied for asylum.156

In early 2020, as the COVID-19 outbreak escalated, FATA announced the formation of a working group for combating “online rumors” related to the spread of the virus.157 According to Iran’s armed forces, by April 2020 some 3,600 people had been arrested for spreading “rumors”.158

Over the past several years, amid domestic political tensions between reformists and conservatives, hard-liners within the judiciary and the IRGC have conducted a campaign against the perceived “infiltration” of foreign ideas, individuals, and companies. Numerous foreigners or Iranians with dual nationality who were active in journalism, human rights work, or ICT development have been imprisoned by the authorities, often with little explanation.159 Nazanin Zaghari-Ratcliffe, an Iranian-British dual citizen, was sentenced to five years in prison in 2016 for allegedly spying and designing websites that support sedition.160 In April 2021, she was sentenced to another year of imprisonment and a one-year travel ban, according to her lawyer.161 She was released in March 2022 along with another British-Iranian detainee, Anoosheh Ashoori.162

The legal status of encryption in Iran is somewhat ambiguous, with the CCL prohibiting “concealing data, changing passwords, and/or encoding data that could deny access of authorized individuals to data, computer, and telecommunication systems.”163 While this could be understood to prohibit encryption, enforcement of the provision is uncommon. Nonetheless, authorities have periodically blocked encrypted traffic from entering the country through international gateways, particularly during contentious events such as elections.164

In April 2020, the CDICC announced the drafting of a regulation for creating “legal VPNs” and assigned the technical aspect of the plan to the ICT Ministry, though the regulation had not been completed by the end of the coverage period (see B7). Under the plan, individuals will likely have to apply to purchase VPNs and secure approval from the government based on need, with factors potentially including one’s profession.

In August 2019, the SCC approved a new resolution entitled “Valid Identity System in Cyberspace.”165 The document calls for individuals to be assigned verified online identification, linked to their legal identification, that would be used for any online interaction. The system would be managed by the ICT Ministry. Should the resolution be fully implemented, it will give enhanced surveillance powers to the authorities and essentially make online anonymity impossible.

The latest version of the “User Protection Bill” is designed to tighten regulations on foreign and domestic online services and includes provisions that would threaten online anonymity by banning unauthorized encrypted communication tools and VPNs (see B1, B2, and C6).166 Specifically, internet users would have their identification verified according to their legal ID to be able to access online services.167 The bill, which was yet to pass Parliament at the end of the coverage period, would force users onto domestic platforms that lack encryption and essential make anonymous communication impossible.

The online sphere is heavily monitored by the state despite Article 37 of the nonbinding Citizens’ Rights Charter, which states that online privacy should be respected.168 In April 2018, Iran’s supreme leader issued a fatwa related to users’ privacy on social media and online messaging, saying the invasion of privacy is against Islamic law.169 However, the fatwa has not been enshrined into law.

A draft bill on data protection and privacy was presented to the cabinet in July 2018 by the previous ICT Ministry (see C2), and new ICT Minister Eisa Zarepour announced hopes of presenting a new draft to Parliament in February 2022.170 The human rights group Article 19 has raised concerns about the content of the proposed bill, citing the lack of independence of the body that would implement the legislation, as well as “the lack of adequate remedies for individuals to counter violations of their rights, and to seek compensation for any damage suffered.”171 A report published by Small Media in April 2019 warned that if implemented, the bill could lead to even greater state control over and surveillance of internet users.172

The state monitors social media for activity it deems illegal. In May 2020, FATA announced that not wearing the hijab online would be considered a crime, and that those who do not follow this rule would be prosecuted (see C3).173

In November 2018, researchers at the Cisco Talos Intelligence Group warned that the Iranian “client” apps for Telegram, which allowed Iranian users to access the platform after it was banned (see B1), could grant authorities access to all the information on a user’s phone.174 Google removed the two apps, Hotgram and Telegram Talaei, from its app store and users’ phones in April 2019, citing security and privacy concerns.175 The apps then shut down in June 2019 (see B2).176 The two apps have been accused of links to the government and the Iranian hacker group Charming Kitten, which in turn is said to be connected to Iran’s intelligence services (see C8).177

State agencies such as the IRGC have pressured or coerced detained activists into handing over log-in details for their social media accounts, which the authorities have then used for surveillance and phishing attacks. This seems to be part of a broader pattern, as several activists have reported phishing attempts that were apparently sponsored by the government.178 According to a report published by the Center for Human Rights in Iran in May 2019, the government still employs malware to target certain groups both within and outside the country to gather private information. Victims of malware attacks include Gonabadi dervishes, ethnic Azerbaijani dissidents, women’s rights activists, and student activists (see C8).179

All service providers and platforms hosted in Iran are subject to arbitrary requests by various authorities to provide more information on their users.

Long term government policies and financial incentives aim to force Iranian users to migrate from international platforms to less secure domestic platforms and services, which do not guarantee the kind of user protection offered by some of their international counterparts.180 Most recently, legislation proposed during the coverage period titled the “User Protection Bill” has concerning provisions around data protection and online privacy and could force users onto less secure domestic platforms. Additionally, the bill requires foreign and domestic online services to register with a supervisory board, and foreign social media and messaging companies would have to “designate an Iranian company as their legal representative” and would be forced to comply with “rules set by the regulator” (see B1, B2, and C4).181 The bill had not passed by the end of the coverage period.

During the coverage period, Iranian social media users reported having their personal and user profile information taken from Instagram and transferred and replicated onto Rubino—a domestic version of Instagram and part of the state affiliated app, Rubika—without their consent or awareness.182 Despite promises of an investigation by FATA Police, it does not appear that the platform was held accountable. A similar incident was also reported on state-linked messaging app Soroush in 2018.183

Since the 2018 ban on Telegram, the government has promoted domestic messaging apps such as Soroush and Bale. In March 2020, it was reported that data from 42 million Iranian Telegram accounts had been leaked online,184 allegedly via Hotgram and Telegram Talaei (domestic apps).185

Concerns were raised about Iran’s COVID-19 detection app, known as AC19, for reportedly “containing malicious spyware,” though this claim was refuted by a malware security expert.186 In March 2020, it was removed from the Google Play store without official justification (see B3). The app, which collects geolocation data, remained available via domestic app stores and its own website. During the coverage period, appointments to receive Iran’s COVID-19 vaccine could be booked by phone or through the messaging app iGap, which has ties to the government.187

In 2017, the SCC released a new resolution outlining a legal framework for messaging apps operating in Iran and formalizing previous demands that foreign messaging apps work with Iranian authorities to obtain licenses and move their data centers inside Iran. The rules also tasked the ICT Ministry with forming a committee to suggest a licensing process for domestic and foreign messaging apps.188

In 2020, the South African telecommunications company, MTN—which has been operating in Iran since 2006 in a joint venture with Irancell—released its first transparency report. According to the report, MTN had received 77,109 requests for location data and numbers identifying specific mobile devices, 77,400 data requests pursuant to criminal investigations, and 69,730 data requests pursuant to service suspension or restriction orders from Iran’s judiciary—some of the highest figures for any country covered in the report.189 The company has about 46.8 million subscribers in the country.

Extralegal intimidation and violence by state authorities is common in Iran. Journalists, bloggers, and activists who are serving prison sentences due to their online activities frequently experience maltreatment and even torture while in detention.

Blogger Seyed Hossein Ronaghi Maleki was arrested in February 2022 after criticizing the “User Protection Bill” on his Twitter account (see C3).190 His home was raided, and he was taken to an unknown location by security officials. Furthermore, rights groups have raised the alarm on his treatment in prison, and according to his brother, Ronaghi Maleki began a hunger strike shortly after his arrest.191

Gender-based online violence is not uncommon. In August 2021, several human rights organizations released statements condemning the continued online threats and harassment against women activists and journalists, both inside and outside the country. Many women cited in the report have received death and rape threats.192 During the coverage period, the BBC filed a complaint to the United Nations about the continued online harassment of their women journalists, including BBC Persian reporter Rana Rahimpour.193 Rahimpour has received violent threats in response to her online reporting, and members of her family have been interrogated and threatened in an effort to silence her.194

At times, the government reaches across borders to repress dissent. In July 2021, four Iranian intelligence officials were arrested in the United States for plotting to kidnap a New York–based Iranian journalist and activist, said to be Masih Alinejad. Alinejad has a large online following and has also created online campaigns against mandatory wearing of the hijab for women. One other person in the United Kingdom and three others in Canada were also targeted by officials. 195

Many suspect that torture occurs in prison. In August 2021, surveillance video footage from inside Evin prison was leaked online, showing disturbing treatment of inmates, including evidence of beatings, sexual harassment, and ill-treatment of inmates in need of medical care.196

Online activist Abdulghafour Ghaderi was arrested in February 2021 after authorities identified him on social media. According to The Baloch Activists Campaign (BAC), Ghaderi was allegedly subjected to physical and psychological torture following his arrest. He was accused of “spreading propaganda against the state, the disruption of public order, and supporting Baloch political groups.”197

In October 2020, Farangis Mazloom, the mother of jailed photojournalist Soheil Arabi, was imprisoned for posting on social media about her son’s condition in detention, which included being moved between prisons, placed in solitary confinement for long periods, injured, and tortured (see C3).198 Arabi, who was arrested in 2013, went on a hunger strike for more than 20 days in July 2019 to protest prison conditions and mistreatment by the authorities.199 He announced that he was going on another hunger strike in April 2020, again in protest of abusive prison conditions and denial of medical care.200

Fatameh Khishvand, the Instagram celebrity known as Sahar Tabar, was arrested in October 2019 as part of a crackdown on popular Instagram profiles (see C3).201 She was coerced into giving a statement following her arrest, which was aired on television.202

Harassment and intimidation short of imprisonment is common. In January 2019, several Iranian Instagram influencers announced that they would wear tighter hijabs in their posts and deleted older pictures with less conservative hijabs or no hijab at all (see B2). FATA had reportedly threatened to suspend the influencers’ profiles if this content was not removed within a week.203

A survey of LGBT+ Iranians conducted by Small Media in early 2018 found that half had experienced online harassment, while one in five reported being entrapped by state or nonstate actors on dating apps.204 This is part of a long-term campaign of harassment against LGBT+ people.205

State hackers often launch cyberattacks against activists and campaigners, including those in the diaspora. Due to growing tensions between the governments of Iran, neighboring countries, and the United States, there has been a notable rise in reported hacking campaigns and cyberattacks affecting Iranians. According to Rest of World, distributed denial-of-service (DDoS) attacks targeted independent media outlets during the coverage period.206

Several cyberattacks on state infrastructure took place during the coverage period. In July 2021, an attack on Iran’s Transport Ministry caused widespread disruption to train services. The entity behind the attack is not known.207 In October 2021 an attack on Iran’s petrol stations disrupted payment systems and caused significant chaos across the country. It is unclear who was behind the attack.208

In July 2021, Facebook reported that it took down 200 accounts that were run by hackers in Iran targeting US military personnel. These accounts are said to have used faked online personas to drive their targets to open malicious links that would infect their devices with malware and spyware (see B5).209

In February 2021, the security company Bitdefender and the radio program Argos had reportedly identified a server in a Dutch data center that was being used by the Iranian regime to “spy on political opponents” in countries such as Germany, the Netherlands, India, and Sweden.210 The server was said to have been a command-and-control unit that could be used to steal and manipulate data from computers infected with malware.

The human rights organization Miaan Group reported in September 2020 that it had identified a malware program that was spread via malicious emails beginning in February 2018, initially targeting the Gonabadi dervishes, a persecuted Sufi religious group in Iran.211 The malware was traced to further attacks in June 2020 and linked to Andromedaa, a private technology firm in Iran’s northeastern city of Mashhad. According to Miaan, Andromedaa “had a pattern of attacking activists, ethnic minority groups and separatist opposition groups” and was capable of developing phishing and malware technology to target the general public. The goal of these tools is to steal information from opposition groups and spy on Iranians who use mobile apps to organize protests.”212 The researchers also identified emails sent to various targets, including human rights organizations and journalists, that contained spyware enabling the attackers to access sensitive data.213

A separate report published by the Center for Human Rights in Iran in May 2019 found that the Gonabadi dervish website Majzooban had suffered state-sponsored DDoS attacks that rendered it inaccessible for hours.214

In March 2021, a hacker group known as Tapandegan hacked and defaced the website of the Economic Affairs and Finance Ministry. The group reportedly claimed to have acquired “confidential” financial information, though these claims had not been verified at the end of the coverage period.215