Internet penetration, bandwidth, and speeds have increased markedly in recent years due to heavy government investment in information and communication technologies (ICTs).

The International Telecommunication Union (ITU) estimated internet penetration at approximately 85 percent in 2019.1 According to the ICT Ministry’s 2019 report, 240,000 kilometers of fiber-optic cables have been installed across the country. The majority of Iran’s population rely on mobile internet for connectivity. The Communications Regulatory Authority (CRA) reported that the mobile internet penetration rate was 100.19 percent as of March 2021, while the fixed broadband penetration rate was 12.61 percent during the final quarter of the previous Iranian year.2

In February 2020, the Supreme Council for Cyberspace (SCC), Iran’s top internet policymaking body, began dedicated meetings to set five-year targets for the expansion of the National Information Network (NIN), the country’s localized internet architecture. The new plan was approved by the SCC in September 2020.3 Some of the targets relating to connectivity included: mobile internet access to be provided for 100 percent of the population with an average speed of 10 Mbps; broadband internet access to be provided for 80 percent of households with an average speed of 25 Mbps; internet speed for businesses to increase to 100 Mbps; and the creation of conditions to connect at least 10 percent of users to the next generation of telecommunications technology.4

A number of NIN-related infrastructure projects and investments have been announced in recent years, demonstrating that, despite the deteriorating economy,5 authorities remain committed to developing the network. In the first quarter of 2021, a number of fifth-generation (5G) mobile network sites were launched in cities including Tehran and Mashhad.6

The creation of a new working group dedicated to satellite-based internet service at the National Center for Cyberspace (NCC) was announced in February 2021, though such a service is not yet available for at-home use in Iran. SCC secretary Abolhassan Firouzabadi stated that international satellite-based internet services could “bring the National Information Network (NIN) under question, if the NIN cannot provide faster, cheaper and better services with more variety.”7

According to a report published by the ICT Ministry in September 2018, Iran’s international internet bandwidth had reached 1,805 Gbps, and the domestic data transition bandwidth was 22,191 Gbps.8 However, both the supreme leader and the parliament have warned authorities against increasing bandwidth before the NIN’s completion.9 This restraint was seen as a way to further hinder Iran’s connectivity to the rest of the world, forcing users to rely on the government-approved network.

Private and state-backed companies have sought foreign investment to improve the ICT infrastructure. In 2017, the South African telecommunications company MTN announced that it would bring fiber-optic networks to the cities of Tehran, Karaj, Qom, Tabriz, Shiraz, Isfahan, Ahvaz, and Mashhad.10 However, in July 2018 the deal was scuttled due to MTN’s apparent failure to adequately fund the consortium.11 The deal’s collapse was also attributed to US sanctions.12

The government’s investment in ICT infrastructure through the NIN has increased connectivity in rural areas, reducing the urban-rural divide, though pricing remains high. The CRA has implemented measures to extend access to rural areas and decrease prices for users.

According to a report published by the ICT Ministry in August 2019,13 80 percent of the infrastructure for the NIN had been completed, with 100 percent of cities connected and 78 percent of villages gaining access to the network. However, the ICT Ministry and the SCC have been in conflict about the validity of these claims,14 a split that has been attributed to the two bodies having “differing definitions of the NIN.” Neither entity has provided evidence to back its assertions, and the true figures for the progress of the NIN are not currently known.

The southeastern province of Sistan and Baluchestan is one of the poorest in Iran, with some of the highest levels of unemployment and the lowest internet penetration rates, according to the CRA. In December 2020, the ICT minister was summoned to a public parliamentary session to answer lawmakers’ questions about connectivity problems in cities across the province as well as in other border provinces, which had particularly affected students seeking to access online learning during the COVID-19 pandemic. Following the public session, the ICT minister traveled to Sistan and Baluchestan and announced that the ICT Ministry had set a target of “connecting 1,200 villages to the NIN.”15

A number of reports have emerged concerning young people in deprived regions of Iran facing difficulties and pressure due to a lack of access to the internet or electronic devices needed to use the online education app Shad, which was introduced during the COVID-19 pandemic, with reports of a student committing suicide as a result these pressures. The issue attracted major public concern, resulting in the introduction of a new bill titled “Free Internet for Students, Teachers, and Schools” to deal with aspects of the digital gap.16

In February 2021, the parliament approved a 10 percent tax increase for internet service providers (ISPs), to be included in the draft budget for the following Iranian calendar year.17 In a social media post, ICT Minister Mohammad Javad Azari-Jahromi commented that the new measure would cause a “significant increase” in internet package prices. After the Guardian Council approved the draft budget in March, it was announced that the increase would take effect for telecommunications companies and ISPs when they next renewed their licenses.18

A bandwidth pricing policy was implemented in 2017, shortly after the appointment of Azari-Jahromi as ICT minister. It prices internationally routed traffic—downloads or uploads of global internet content—at a higher rate than domestically hosted websites (through the NIN) and other government-approved content (see B7).19 In 2017, the provider MTN Irancell announced that consumers using virtual private networks (VPNs) would not receive the 50 percent discount when accessing domestic content, further discouraging the use of circumvention tools to access restricted content.20

Score Change: The score improved from 1 to 2 because there were no nationwide, long-term shutdowns similar to those during the previous reporting period, though authorities continued to impose localized internet shutdowns amid protests in the provinces of Khuzestan and Sistan and Baluchestan.

Multiple network disruptions took place over the course of the reporting period. The development of the NIN and the state’s control over the internet backbone allow the authorities to throttle global-internet connection speeds during politically sensitive periods without crippling critical domestic services such as hospital networks and banking activity.

The Telecommunication Company of Iran (TCI) retains a monopoly on internet traffic flowing in and out of the country.21 In addition, the TCI’s dominance of the ISP market creates opportunities for the security apparatus to monitor online activity, since the company’s majority shareholder is the Islamic Revolutionary Guard Corps (IRGC), a powerful branch of the security forces that also controls large portions of the economy (see A4).22

After the reporting period, the latest version of the “User Protection and Core Online Services” bill designed to restrict online content and tighten regulations on foreign and domestic online platforms returned to the parliamentary agenda in June 2021. The bill calls for the country’s internet gateways to be controlled by a working group comprised of the armed forces, the IRGC’s intelligence agency, the Ministry of Intelligence, the ICT Ministry, the Judiciary, and the Passive Defense Organization.23

On February 24, 2021, a near-total internet shutdown was implemented in Sistan and Baluchestan in response to protests across the southeastern province. Reports first emerged of IRGC forces clashing with fuel traders in the city of Saravan on February 22, with at least 10 people killed and five others injured.24 The incident sparked protests outside the local governor’s office in Saravan the following day. As protests expanded to the city of Zahedan, with reports of the supreme leader’s photograph being burned by demonstrators outside the office of the IRGC’s Intelligence Organization on February 24, the first signs of internet disruptions emerged. At around 9:30 p.m. local time that evening, mobile data connections were heavily disrupted, and by 9:40 p.m. all mobile operators were disconnected from the internet in the cities of Zahedan, Khash, Saravan, Zabol, and Chabahar.25 Unlike the nationwide internet shutdown in November 2019, during which some services hosted on the NIN—such as banking and health systems and domestic messaging apps—remained available, this localized shutdown cut users off from both NIN-hosted and international services.26 While some connections were temporarily restored, internet speeds remained slow. The shutdown lasted until February 27. Broadband connections remained in place during this time, but because over 95 percent of users in the province rely on mobile internet, the disruption was almost comprehensive in effect.

Earlier in the coverage period, on July 16, 2020, mobile internet connections were cut off in neighborhoods of the city of Behbahan, Khuzestan Province, where protests were taking place. Connections were restored by midnight as the protests came to an end. According to Filterwatch, users just 2 kilometers away from the protests were able to access the internet.27 Officials did not publicly acknowledge the shutdown. Separately the same month, network disruptions were reported in Iran for about three hours as users shared hashtags on social media to speak out against death sentences handed down to three men who participated in the 2019 protests (see B8).28

A number of social media and messaging platforms are blocked in Iran (see B1). The messaging app Signal was blocked in January 2021. Its website became inaccessible a few days prior to its blocking, and it was removed from Iranian app stores in accordance with orders from the Committee to Determine Instances of Criminal Content (CDICC).29 Signal was previously blocked and unblocked in December 2017.30 Iranian officials did not explain or take responsibility for either incident. Signal has since added a transport layer security (TLS) proxy that can be set up as an “interim solution” in order to “bypass the network block.”31

The near-total internet shutdown imposed in November 2019 lasted for at least seven days and affected mobile and broadband connections across most of the country. Certain provinces, such as Sistan and Baluchestan and Khuzestan, experienced even longer shutdown periods.32 The decision to disconnect the country from the global internet was made by the National Security Council following a wave of protests sparked by the sudden announcement of a significant increase in fuel prices.33 No prior notice was given to users, and no parliamentary approval was sought to extend the shutdown beyond its initial 24-hour period.34 While Iran had implemented more limited internet shutdowns in the past, the November 2019 interruption was the first “blanket shutdown,” and was difficult for many users to circumvent via VPNs and other tools “due to its comprehensive nature.”35

Weeks later, in December 2019, major network connectivity disruptions were observed over two days as heightened security deployments in parts of the country were reported. However, this did not lead to a wider shutdown.36 Significant internet disruptions were observed once again in January 2020 as protests broke out in the aftermath of the shooting down of the Ukraine International Airlines Flight 752 passenger plane by Iran’s armed forces.37 The government’s initial denial and eventual acknowledgment of responsibility for the tragedy led many people to take to the streets across the country.

Internet disruptions and connectivity issues reemerged as the COVID-19 crisis worsened in Iran during March 2020. These appeared to be due to strains on network infrastructure as ISPs struggled with the dramatic increase in demand from users attempting to work remotely or otherwise access services from home.38

The telecommunications industry is tightly controlled by the government. The TCI owns the Data and Communication Company (DCC), the country’s main ISP. The Mobile Telecommunication Company of Iran (MCI), a subsidiary of the TCI, is the largest mobile service provider.39

In January 2018, the supreme leader ordered the IRGC and other security forces to reduce any economic activities that were not related to their core missions,40 and in October 2018, the guard corps announced that it was selling its stake in the TCI.41 However, at the end of the coverage period there was no indication that the sale had taken place.

The second-largest mobile service provider, MTN Irancell, is owned by MTN and Iran Electronics Industries, a state-owned subsidiary of the Ministry of Defense.42

The ICT Ministry and Islamic Republic of Iran Broadcasting (IRIB)—the state broadcaster, whose head is appointed directly by the supreme leader—still appear to be at odds on the right to license internet protocol television (IPTV) services. The ministry has sought to capitalize on expanded bandwidth by promoting IPTV as a new avenue for media diversity. However, in 2016, the IRIB notified all private IPTV providers that licenses issued to them by the ICT Ministry were invalid, insisting that only the IRIB has the power to issue licenses.43 The broadcaster began issuing its own licenses in 2017.44 In January 2020, a notice signed by then chief justice Ebrahim Raisi was sent to regional judiciary officers, stating that the IRIB is responsible for issuing licenses and regulations relating to audio and video content online. Shortly thereafter, Mahmoud Vaezi, the president’s chief of staff, responded to Raisi in a letter, stating “with respect, these matters related to the SCC.”45 The issue remained unresolved at the end of the coverage period.

The bodies that regulate the telecommunications sector lack independence. The SCC, which sets most policies related to the internet, was established through a 2012 decree by the supreme leader and is composed of 17 representatives from government institutions and 10 members appointed by Ayatollah Khamenei.46 It is intended to provide a centralized point for policymaking and the regulation of Iran’s virtual space, effectively minimizing the roles of the executive, legislative, and judicial branches and bringing internet policy under the supreme leader’s direct control.

The CRA, which falls under the ICT Ministry, is responsible for telecommunications licensing. Its head is appointed by the ICT minister.47

In 2015, Khamenei consolidated the SCC’s power over internet policy and made some personnel changes to the council. In 2016, he dissolved the High Council of Informatics, the Supreme Council of Information, and the Supreme National Security Council of Information Exchange (AFTA), incorporating their responsibilities into the SCC.48

In the past, government officials routinely criticized the SCC for being disorganized,49 and for neglecting to encourage Iranians to use the internet in a “clean” and Islamic fashion.50 Since the appointment of Azari-Jahromi as the ICT minister, SCC meetings have been held more often,51 though the council did not meet for three consecutive months after the COVID-19 outbreak intensified in the country beginning in February 2020.52 The meetings were then held less frequently during the latest coverage period, coinciding with President Hassan Rouhani’s final year in office and the run-up to the June 2021 presidential election.

Authorities restrict access to tens of thousands of websites, particularly those of international news and information services,53 the political opposition, ethnic and religious minority groups in Iran, and human rights organizations.54 Websites are also blocked if they contradict state doctrine regarding Islam or government narratives on domestic or international politics. News stories that cover friction between Iranian political institutions are frequently censored.

Twitter, Facebook, Telegram, and YouTube are all blocked or filtered, as are major blog-hosting platforms like Wix, WordPress, Blogspot, and Blogger.55 Conservative leaders have repeatedly exerted pressure on the CDICC—a government body headed by the prosecutor general that consists of representatives from 12 state institutions—to block other prominent social media platforms. After the reporting period, the latest draft of a bill initially proposed in 2018 returned to the parliamentary agenda in June 2021, which requires foreign and domestic online platforms to register with a supervisory board and comply with Iranian laws or face penalties, including blocking or throttling, or being replaced with “domestic alternatives” as approved by the new supervisory body.56 The bill had not passed by the end of the coverage period.

Internet censorship is highly politicized, often reflecting tensions between conservatives and reformists within the regime. In January 2021, ICT Minister Azari-Jahromi was summoned to the Culture and Media Court for questioning about a number of claims made against him, including noncompliance with a May 2018 order to block Instagram.57 A few days later, government spokesperson Ali Rabiee warned that the filtering of Instagram could lead to “job losses for one million Iranians.”58 Instagram remains available despite calls for it to be blocked, though reaching the platform is often difficult in practice,59 and widespread disruptions in access were reported in February 2021. Iranian officials did not provide an explanation for the episode (see B3).60 In May 2021, ahead of the presidential election, a leaked letter from the judiciary indicated that authorities had planned to filter Instagram, Google Play, and a number of VPN services as calls to boycott the upcoming vote mounted on social media.61 However, the order was “revoked” shortly after being issued.

Instagram and WhatsApp were among the few international platforms still available in Iran at the end of the coverage period. The messaging app Signal was blocked in January 2021 (see A3). In April 2021, the audio discussion app Clubhouse, which had quickly gained popularity among Iranian journalists, politicians, state elites, and activists, was blocked by the leading Iranian providers.62 Once again, no official took responsibility for the decision.

Apps and websites have been blocked in recent years over their links to foreign countries. For example, the navigation app Waze and the messaging app Viber, which were developed in Israel, were first blocked in 2017 and 2014, respectively.63 As Telegram—which operates primarily from the United Arab Emirates—gained popularity, the government blocked its encrypted voice-calling feature in 2017, then blocked the entire service for several days in late 2017 and early 2018 in response to antigovernment protests.64 In April 2018, a prosecutor in the Media Court issued an order to filter Telegram, resulting in the obstruction of the platform by ISPs and mobile service providers.65 Authorities have since promoted domestic alternatives (see C6).66

In April 2019, two Iranian-made Telegram “client” apps—Hotgram and Telegram Talaei—that gave users access to the service following its ban were taken down as well. Some reports suggested that the two apps were connected to intelligence services inside the country and could allow surveillance of users’ phones (see C5).67 Separately, in January 2018, the government reportedly lifted a long-standing ban on the Chinese messaging app WeChat.68

An October 2019 letter signed by Javad Javidnia, then the deputy prosecutor general responsible for cyberspace and secretary to the CDICC, asked ISPs to block the official Android app store and the Google Play store “as soon as possible.”69 The letter stated that the decision was made by the CDICC “in accordance with Article 749 of the Islamic Penal Code relating to computer crimes.” Article 749 requires all ISPs to filter any content determined by the CDICC to be criminal content. Resistance in complying with this article can result in the termination of the ISP or in some cases a financial penalty.70

On November 26, 2019, shortly after that month’s fuel-price protests had died down, a number of users on social media reported that they had been unable to access Wikipedia, indicating that the website was blocked.71 Similarly, in early March 2020, as the country was battling one of the largest outbreaks of COVID-19 outside of China, reports confirmed that access to Persian-language Wikipedia had been blocked, though officials did not comment on the incident.72 The head of Persian Wikipedia, Mohsen Salak, said in an interview with an Iran-based news website that he did not know what was causing the disruption.73 The site was unblocked after around 24 hours.74

A 2021 report on LGBT+ online censorship from the Open Observatory of Network Interference (OONI), OutRight Action International, and Citizen Lab found that seventy-five unique LGBT+ URLs have been blocked in Iran. According to the repot Iran extensively censors LGBT+ content, including content such as human rights, culture, and news websites.75

Domestic news sites are frequently blocked for criticizing the government. Anar Press and Aban Press, for example, were blocked after the editor in chief of both sites was arrested in April 2019.76 In 2016, Memari News was blocked on the order of the public prosecutor of Tehran after it published a letter from a judicial body to the Tehran municipality that exposed corruption.77 Borna News, Moj News, and Nasim News were similarly blocked in 2016.78

Authorities have sometimes restricted commercial websites for various reasons. During 2018, nearly 180 commercial tourism websites were blocked over suspected licensing violations,79 and a number of sites selling digital currencies were also blocked.80 In October 2019, the judiciary ordered the filtering of free movie download websites to “protect intellectual property rights,”81 after competing fee-based download and streaming services submitted complaints.

Users in Iran frequently employ circumvention tools to access blocked web content. In a May 2019 media interview, Michael Hull, the head of the circumvention provider Psiphon, claimed that between one and two million people in Iran used its service daily.82 However, the government regularly seeks to disrupt access to VPNs and has also made efforts to establish a “legal VPN” scheme in order to control access to the tools (see B7 and C4).

Authorities employ a centralized filtering system that can effectively block a website within a few hours across the entire network. Private ISPs are forced to either use the bandwidth provided by the government or route traffic containing site-visit requests through government-issued filtering boxes developed by software companies within Iran. The filtering boxes inspect URL requests submitted by users for banned text strings—either keywords or domain names—and block access accordingly. This method only limits access to content retrieved through unencrypted Hypertext Transfer Protocol (HTTP) connections. Individual pages remain available over an encrypted connection (HTTPS), which disguises the banned text, requiring censors to block the entire site in order to restrict access to specific content.83

Authorities frequently employ administrative measures to force the removal of legitimate online content.

In October 2020, the founder and manager of Aparat, Iran’s domestic video-sharing platform, was sentenced to 10 years in prison (see C3). The CEO, Mohammad Javad Shakuri Moghadam, was charged with “encouraging corruption” after a video was posted by a user to his platform. In the video, children were asked if they knew how they were born. The video was removed an hour after it was posted.84

In May 2021, Aparat stated in a social media post that an interview with former president Mahmoud Ahmadinejad had been removed following an order from the Audio-Visual Regulatory Authority (SATRA), which operates under the IRIB, though it did not state the reason.85 Following public backlash online, SATRA stated that the decision was “made in error.” Separately, in March 2021 SATRA began investigating the Iranian social media app Rubika after it played a teaser for the music video “Tehran Tokyo” by the US-based Iranian singer Sasy (see C3).86 The outcome of the investigation was unclear at the end of the coverage period.

Under an August 2019 order signed by Javidnia, the then deputy prosecutor general responsible for cyberspace, internet hosting companies inside the country are banned from providing services to filtered websites and can face prosecution for doing so (see B1).87 The affected sites include those carrying news and information about human rights or other politically relevant content, which are now forced to rely on international hosting companies or shut down entirely.

Content removals were common during the 2017 presidential election period. According to the Center for Human Rights in Iran, hours after the Rouhani campaign published a video in which reformist former president Mohammad Khatami declared his support for Rouhani’s reelection bid, campaign officials were told by the judiciary to delete the video from social media or face arrest.88

The IRGC routinely arrests Telegram group administrators in order to coerce them to remove content or delete their channels from the platform (see C3). The practice was prevalent in the months prior to the 2017 presidential election, when the reformist-aligned Telegram channels operated by Eslahtalaban News, Eslahat News, Majmeye Eslahtalaban, and Haamiyan Dolat were either deleted or stopped publishing due to the arrests of their administrators.89 The prosecutor general stated in 2017 that the judiciary issued orders to block tens of thousands of Telegram channels every week, but company representatives denied accusations that they complied with censorship beyond the removal of terrorist content and pornography.90

In March 2019, the Iranian Android app store Myket reported that the CDICC had ordered it to remove 12 apps, including Wizz, WeChat, Tango, and IMO. Myket complied with the order.91

Censorship decisions are made by the CDICC, and they are often arbitrary and lacking in transparency. Though other bodies, such as the judiciary, have also ordered filtering decisions, such as the ban on Telegram. Such decisions are ostensibly based on the 2009 Computer Crimes Law (CCL), which outlines a broad range of banned content, from insulting religious figures and government officials to distributing pornographic content and using illegal circumvention tools.92 In practice, little information is available about the inner workings of the committee. State authorities did not take responsibility for the 2021 blocking of Signal and Clubhouse during the reporting period, indicating that decisions on internet restrictions are becoming increasingly opaque.

The prosecutor general leads the CDICC and is responsible for convening the body’s meetings.93 In January 2019, two members of parliament who sat on the CDICC wrote to the parliament speaker to complain about the lack of regular meetings and question the legality of its attempts to hold online votes on the filtering of websites.94 The prosecutor general’s reluctance to call meetings may have stemmed from the fact that the ICT Ministry and its allies likely had enough votes to reject attempts to block certain sites.95

Website owners must register their sites with the Ministry of Culture and are then subject to requests to remove posts deemed unacceptable by the government (see B6). The 2009 CCL makes hosts such as blogging platforms responsible for any content that appears on their sites. This has led to the suspension of blogs and the shuttering of news sites hosted on platforms inside Iran, under orders from government officials.

The latest draft of a bill initially proposed in 2018 returned to the parliamentary agenda in June 2021, after the reporting period. The bill would make foreign and domestic online platforms register with a regulatory body and comply with Iranian laws - including requests for content removal - or face penalties (see B1 and C6).96 The draft bill would further limit content available online and would make companies responsible for removing content deemed inappropriate under Iranian law.

The November 2019 internet shutdown was implemented without prior notice and without clarity about its length (see A3). The National Security Council stated only that the shutdown was in place for “national security reasons,” and did not consult with the parliament on extending its duration. There is currently no legislation providing for checks and balances on the implementation of internet shutdowns.97

Following a US drone strike in Iraq that killed Qasem Soleimani, commander of the IRGC’s elite Quds Force, in January 2020, many Iranians, including journalists, took to Instagram to post about the event. Instagram then began removing posts related to Soleimani’s death, citing “compliance with US sanctions.”98 At least 15 Iranian journalists and news agencies, including the IRGC-affiliated Tasnim News agency as well as the Iran Newspaper and Jamaran News, had their accounts removed or suspended. Separately, some foreign-based Bitcoin trading platforms have restricted access for Iranian users; reports suggest that the change is likely due to US sanctions.99

In March 2020, Google removed an Iranian COVID-19 tracking app known as AC19 from the Google Play store. The company did not provide an explanation. While Iranian users raised concerns about the app’s security, in light of its collection of geolocation data, claims that the app contained surveillance software or malware were challenged by an expert with the online security firm ESET, who did not find the app to be “a malicious Trojan or spyware.”100 Nevertheless, the lack of transparency from the authorities as to why the data were being collected and what it was being used for was a major concern, given the government’s history of conducting surveillance against its citizens (see C5). Suspicions grew when it was revealed that the app had been developed by Smart Land Solutions, the Iranian company behind the Telegram “client” apps Telegram Talaei and Hotgram, which were rumored to be linked to the intelligence services.

Former ICT minister Mahmoud Vaezi suggested in 2016 that the country may transfer more censorship authority to ISPs during the next phase of the NIN’s development.101 Empowering ISPs to censor content may result in more repressive practices, since the IRGC is a dominant player in the ISP market, and reformists in the government would be unable to counter such decisions. The NIN project also aims to move much of the content and many of the websites accessed by users to domestic servers, where traffic can be closely monitored and censored by the authorities.

Self-censorship among journalists and other users is extensive, particularly regarding political issues.

The arrests and imprisonment of journalists, activists, and ordinary citizens in retaliation for their online activities, as well as perceptions of pervasive surveillance, contribute to self-censorship. Many journalists and bloggers abandoned their online activities or used pseudonyms after the crackdown on 2009 protests linked to that year’s disputed presidential election, resulting in a noticeable reduction in the amount of original content produced by users. Tight restrictions on journalism and online speech remain in place, and journalists continue to be prosecuted in connection with their work (see C3). In addition, the intimidation of content producers, particularly on Instagram, has caused a rise in self-censorship on social media platforms (see C7).

In September 2019, Sahar Khodayari, who later became known as “Blue Girl,” died after self-immolating outside the Islamic Revolutionary Court of Iran in Tehran following her prosecution for attempting to enter the Azadi sports stadium in violation of gender-segregation rules.102 Authorities limited reporting by state media around the event, which drew attention to violations of women’s rights in Iran (see B5). Parviz Parastui, a prominent Iranian actor, took to his Instagram page to voice his anger about Khodayari’s prosecution and corruption in the judiciary,103 but the post was removed a day later without explanation.

The state counters online criticism through an extensive digital propaganda apparatus.

The regime has backed numerous initiatives to promote blogging among its supporters and members of the Basij paramilitary group.104 For example, an Iranian cultural center has sponsored the annual National Cyber Jihad Festival for bloggers to promote conservative religious values online.105 Authorities also actively support the creation of state-sanctioned social networking sites and mobile apps by offering free bandwidth and hosting to local developers.106 Increasingly, extensive state-aligned cyber operations spread disinformation and manipulate the online space both domestically and abroad.107 The IRGC similarly uses state-owned media to spread disinformation online, in part by regularly misrepresenting European and US commentators as supporters of Iran’s policies.108

In February 2021, Twitter removed 130 accounts “originating in Iran” that had attempted to “disrupt the public conversation” during the 2020 US presidential election period.109 Twitter added that the accounts had “low engagement” and “did not make an impact on the public conversation.” Following the January 2020 assassination of Qasem Soleimani in a US drone strike, a number of Twitter accounts claiming to be located in Iran began posting hashtags such as #hardrevenge with images of Soleimani.110 However, the source of the Twitter campaign remained unclear.

In January 2019, Facebook announced that it had removed 783 pages, groups, and accounts, including some on Instagram, “for engaging in coordinated inauthentic behavior tied to Iran.” The accounts targeted users in various countries, particularly non-Persian speakers, and in some cases used state media content. The posts, some originating as far back as 2010, largely consisted of news reports.111

Telegram played a significant role in the 2017 presidential election, with both major candidates’ campaigns deploying sophisticated tools including chat bots to disseminate political messages and push back against the other side’s rhetorical attacks. In addition to videos of campaign events, both campaigns shared short audio clips of key passages from the candidates’ speeches. The campaigns were also professionally integrated across platforms, using Telegram to direct followers to relevant content on Instagram and other services.112 Ahead of the June 2021 presidential election, candidates flooded Clubhouse to campaign, and in some cases, spread progovernment propaganda.113

Since the filtering of Telegram in April 2018, the SCC has provided official backing to domestic messaging apps such as Soroush, Bale, and Gap, branding them as eligible for official use and promotion by governmental bodies in an attempt to increase their user base.114 Given that the operation of domestic messaging apps is based inside the country, content shared on them is more susceptible to government control and surveillance.

News sites and journalists are consistently warned against covering sensitive political or social topics, such as controversial former presidents like Khatami.115 Ahead of the June 2021 presidential election, a number of journalists received judicial warnings about election coverage, with some reporting harassment from the Cyber Police (FATA) and the IRGC’s cyber unit, according to the International Federation of Journalists.116 As the COVID-19 pandemic began to spread across Iran in 2020, Iran’s leadership was accused of downplaying the extent of the outbreak and underreporting the number of cases.117 Journalists were ordered to announce only official numbers provided by the Ministry of Health.118

During the November 2019 protests and subsequent internet shutdown, journalists and media outlets were issued official guidelines from the Ministry of Intelligence and the Ministry of Culture and Islamic Guidance on how to cover the news.119 They were threatened with criminal prosecution if they strayed from the ministries’ instructions, which required outlets to downplay the protests and avoid making them into “headline news,” despite the fact that they led to hundreds of deaths and thousands of arrests. Journalists were directed to portray the demonstrations as civil protests or “turbulence,” without mentioning the extent or violence of security forces’ response.120

Internet-hosting companies inside the country are banned from providing services to filtered websites and can face prosecution for doing so.121 Sites that contain news and information about human rights and other politically relevant content are forced to rely on international hosting companies or shut down.

In August 2019, the ICT Ministry announced a new sign-up scheme for journalists to receive “free internet” for a year as part of the celebration of “Journalists’ Day.”122 The scheme was expanded to include journalists who had not signed up after the Ministry of Culture and Islamic Guidance provided their details to the ICT Ministry. It is possible that the initiative may give authorities control over the online data associated with the free internet connections, and allow for further government influence over national media outlets (see C5).

There are a number of regulatory and economic constraints that affect the ability of users to publish online. Only apolitical and progovernment websites receive online advertising revenue. Google does not allow advertising campaigns to target Iran,123 disadvantaging domestic outlets as well as those in the diaspora seeking to cultivate an audience inside the country.

In addition, given the tighter economic sanctions associated with the US government’s “maximum pressure” campaign, many international tech companies have ceased offering their services to Iranian users.124 For example, Samsung and the Apple Store have restricted services to Iranians,125 and some Bitcoin sites have withdrawn from the Iranian market (see B2).

Sanctions became a focal point of discussion during the November 2019 internet shutdown, as observers noted that the economic penalties had forced many Iranians to use domestic services, making shutdowns of global internet access much less costly for Iran (see A3).126 In January 2021, the software development platform GitHub confirmed that it had secured a license from the US Office of Foreign Assets Control (OFAC) in order to resume services in Iran.127 GitHub, which had implemented restrictions in 2019, confirmed that it was in the process of “rolling back all restrictions on developers in Iran.”

The government’s moves to prioritize local content through differential pricing threatens net neutrality, the principle that service providers should not discriminate against certain types of content or traffic. In 2017, the ICT Ministry implemented an information-network tariff,128 with a 50 percent discount for data on all domestic websites.129 Since the rollout of the 50 percent discount, users have received even larger discounts for a number of domestic services, such as streaming websites and domestic messaging apps, and in some cases ISPs have eliminated the tariff entirely for the favored services, a move supported by authorities.130

By splitting domestic and international traffic and creating price incentives for users to browse domestic content, Iran has created barriers to media diversity and innovation (see B6).131

Instagram is often used as a news source and a platform to discuss politics.132 Aparat, an Iranian website similar to YouTube that enjoys less expensive tariff rates, is the second-most visited website in Iran, after Google.133 Content on Aparat is governed in accordance with Iranian law, making it difficult for users to share or access socially or politically sensitive views. Internet hosting companies inside the country are banned from providing services to filtered websites under threat of prosecution (see B2).134

VPNs are commonly used to protect online privacy and to circumvent the government’s filtering. They are available to purchase inside the country and have been a topic of debate among politicians for some time. In April 2020, SCC secretary Abolhassan Firouzabadi announced that the CDICC had drafted a regulation for creating “legal VPNs” and had assigned the technical aspect of the plan to the ICT Ministry, though at the end of the coverage period it had not yet been completed. It is expected that individuals will have to apply to purchase VPNs and secure approval from the government based on their need, with factors potentially including one’s profession (see C4). If the legal VPN rules are fully implemented, the government may be able to control and monitor the levels of access different people will have to the internet, among other effects (see A2).135

Despite formal blocks on Facebook, Twitter, YouTube, and other international services, social media platforms play an important role in allowing dissidents to pursue online campaigns and share information. Instagram and Telegram in particular are popular communication tools for activists.

In July 2020, an Iranian court approved the request for a retrial of three men who were sentenced to death due to their participation in anti-government protests. The court’s decision followed an online hashtag campaign against the executions. The hashtag #do_not_execute was shared more than seven million times online.136

In August 2020, Iranian women used Twitter to share their stories of sexual violence and denounce the harassment and abuse they suffered, with some using the hashtag #MeToo, which became popular in the United States and elsewhere in 2017. Many women chose to use pseudonyms online, but some journalists contributed under their real names. The #MeToo movement in Iran has elicited mounting support on social media and offline. Specifically, lawyers have offered pro bono legal advice, anticipating that in the Iranian context, the accusers could face repercussions for speaking out.137

Social media are also employed to engage in political debates. Ahead of the June 2021 presidential election, Iranians used the platforms to call for a voter boycott,138 and candidates campaigned on Clubhouse.139 In the run-up to the 2017 presidential election, all of the main candidates used social media platforms and messaging apps, particularly Instagram and Telegram, as campaign tools. Even conservative candidates who had once railed against social media used such platforms, reflecting their political importance in Iran (see B5).140

Access to the internet, especially mobile internet and social media platforms such as WhatsApp, is often restricted during times of political unrest.141 In response to the November 2019 fuel-price protests, the government implemented a near-total internet shutdown for at least a week, restricting the flow of information coming into and out of the country, as well as communication inside the country (see A3). Localized internet shutdowns were reported in July 2020 and February 2021 in response to antigovernment protests in the provinces of Khuzestan and Sistan and Baluchestan, respectively (see A3). In January 2020, during the protests that followed the shooting down of Ukraine International Airlines Flight 752 by Iranian armed forces, 3G and 4G mobile services were disconnected around Azadi Square in Tehran, where many demonstrators were gathering. WhatsApp’s connectivity was also disrupted during this time.142

In the spring of 2019, when parts of the country faced major flooding, Iranians took to Twitter to highlight how the filtering of social media platforms, particularly Telegram and Twitter itself, hindered emergency relief efforts. Many called for the bans to be lifted.143

After November 2018 protests in which labor activist Esmail Bakhshi was detained, fellow workers at the Haft Tapeh sugarcane company used their Telegram channel to regularly publish statements about his arrest and mistreatment.144 In January 2019, Bakhshi used Instagram to post a letter detailing the torture he faced in prison; he was subsequently rearrested.145

A series of antigovernment protests that erupted in late 2017 focused on a variety of issues, including the compulsory hijab, corruption, and economic hardship. Social media were used to expand the protests to cities across the country through the first week of January 2018, despite violent clashes with security forces. Additional demonstrations occurred later in the year.146

The constitution and legal framework do not protect freedom of expression and press freedom online. The head of the judiciary is appointed by the supreme leader, and the courts in general lack independence. In July 2021, after the coverage period, Khamenei appointed deputy judiciary chief Gholam Hossein Mohseni Ejei to lead the judiciary, after the former head, Ebrahim Raisi, was elected to the presidency in June.147 Raisi’s past role as a member of Tehran’s “death commission,” responsible for the executions of thousands of political prisoners in 1988, stoked strong opposition to his appointment from international human rights groups.148

The constitution provides for limited freedom of opinion and expression, but a variety of haphazardly enforced statutes limit these rights in practice. In 2016, President Rouhani launched the Citizens’ Rights Charter,149 a nonbinding document that includes commitments to freedoms of speech and expression “within the limits prescribed by the law.”150

Numerous laws tightly restrict online speech and allow harsh punishments for those who deliberately flout the constraints or inadvertently draw the ire of authorities. The 2000 Press Law, for example, forbids the publication of ideas that are contrary to Islamic principles or detrimental to public rights, none of which are clearly defined. The government and judiciary regularly invoke this and other vaguely worded legislation to criminalize criticism of the regime, including online.

The 2009 CCL outlines punishments for spying, hacking, piracy, phishing, libel, and publishing materials deemed to damage “public morality” or result in the “dissemination of lies.”151 Punishments are severe and include the death penalty for offenses against public morality and chastity, as well as long prison sentences, draconian fines, and other penalties for service providers that fail to enforce government content restrictions.152 The repressive penal code also applies to online activities.153

A new resolution, “Document on Preventing and Combating the Dissemination of Misinformation and Fake News and Content,” was ratified in an SCC meeting chaired by President Rouhani in January 2021. The resolution seeks to establish a legal framework in collaboration with a number of ministries and the judiciary to address what it refers to as “fake news” in online spaces.154 The judiciary was asked to propose a draft bill that would set out definitions and punishments related to “fake news” as well as the responsibilities of publishers and platforms.155 Given the authorities’ history of restricting press freedom and freedoms of expression and speech online, the resolution appears to be calling for another censorship tool. Its scope could also encourage more self-censorship by the press and others inside Iran who wish to avoid prosecution (see B4).

In February 2018, ICT Minister Azari-Jahromi published drafts of five bills meant to codify the legal regime governing ICT policy in Iran.156 The five pieces of legislation address e-government, electronic identification, the responsibilities of service providers, electronic financial transactions, and data protection, respectively (see C5). Despite their broad reach, none of the proposed bills deal with the restrictions on internet users’ human rights imposed by the CCL.157 The bills had not been passed into law by the end of the latest coverage period.

As the COVID-19 pandemic emerged in February 2020, a spokesperson for the parliament’s judicial and legal affairs committee, Hassan Norouzi, warned that under the penal code, those who “spread fake news or rumors” about the coronavirus could “be sentenced to between one [and] up to three years in jail as well as flogging.”158

The authorities routinely arrest and impose harsh sentences on journalists and social media users for their online activities. Those affected in recent years have included prominent activists, Instagram celebrities, editors at independent news outlets, and citizen journalists associated with persecuted religious groups like the Gonabadi dervishes and Baha’is.159

In October 2019, Ruhollah Zam, the France-based journalist and founder and administrator of the Telegram channel Amad News, a popular antigovernment news outlet with around 1.4 million subscribers, was arrested after allegedly being abducted from Iraq, and his Telegram channel was seized by the IRGC.160 The government had previously accused Amad News of inciting protests in 2017 and 2018 and of being affiliated with foreign intelligence services.161 Zam faced 17 charges, including “spying for French intelligence services” and “collusion with the US government against the Islamic Republic of Iran.”162 In June 2020, he was found guilty of “corruption on earth” and sentenced to death.163 Following an appeal, Zam’s sentence was upheld by Iran’s Supreme Court. A judiciary spokesperson confirmed that he was executed by hanging on December 12, 2020.164

In October 2020, the founder and manager of Iran’s domestic video-sharing platform Aparat, Mohammad Javad Shakuri Moghadam, was sentenced to 10 years in prison. Shakuri Moghadam was charged with “encouraging corruption” after a video was posted to Aparat that asked children if they knew how they were born. The video was removed an hour after it was posted (see B2).165

In March 2021, the judiciary reported that a number of people involved in the production of the music video “Tehran Tokyo” by US-based Iranian musician Sasan Yafteh, also known as Sasy, had been arrested.166 It warned that users who shared the video online would be prosecuted (see B2).

In August 2019, dozens of Instagram “influencers” with large online followings were summoned by FATA as part of a crackdown on online behavior deemed inappropriate by the authorities, such as women posting photos of themselves without the hijab or maintaining accounts focused on modeling and fashion shoots.167 Though some detainees were released on bail or received warnings, others were charged with posting “criminal content” and forced to hand over passwords and account details to the police, according to an investigation by the Center for Human Rights in Iran.

Following the crackdown, in April 2020, popular Instagram couple Ahmad Moin-Shirazi, a former world kickboxing champion also known as Picasso Moin, and his wife Shabnam Shahrokhi revealed that they had been sentenced in absentia on charges of “propaganda against the regime” and “spreading obscene and vulgar content” on social media.168 According to Instagram posts by the couple, Shahrokhi was sentenced to seven years in prison, 74 lashes, and three months of community service, while Moin-Shirazi was sentenced to nine years in prison. The couple had fled to Turkey in September 2019 after harassment by the government and remained in exile.

During the November 2019 protests, journalist Mohammad Mosaed was arrested by security forces for posting on social media about the internet shutdown.169 He was also arrested and interrogated by the IRGC in February 2020 regarding posts in which he criticized the government’s response to the COVID-19 outbreak, and he was forced to delete his Twitter and Telegram accounts.170 Mosaed was sentenced to four years and nine months in prison, as well as a two-year ban on journalism activities and use of all communication devices, in September 2020.171 He fled to Turkey in January 2021 and applied for asylum.172

Fatameh Khishvand, an 18-year-old Instagram celebrity also known as Sahar Tabar, was arrested in October 2019 as part of the broader crackdown on popular profiles. She was charged with offenses including “corruption on earth” and “incitement to corruption by encouraging youths to engage in lunacy,” having posted altered photos of herself that gave her a zombie-like appearance.173 She was coerced into giving a statement following her arrest, which was aired on television. She contracted COVID-19 while in prison in April 2020 and was placed on a ventilator in a Tehran hospital, but authorities refused requests for her temporary release (see C7). She was sentenced to 10 years in prison in December 2020. According to Khishvand, two of the four charges against her were dropped and she was appealing her sentence.174

In early 2020, as the COVID-19 outbreak escalated, FATA announced the formation of a working group for combating “online rumors” related to the spread of the virus.175 According to FATA, by April 2020 some 3,600 people had been arrested for spreading “rumors” online.176

The authorities’ definition of “rumors” remained unclear, and in practice some citizens and journalists were arrested for online reporting and social media posts that either included COVID-19 statistics from sources other than the government or simply found fault with the government’s response to the crisis.177 In March 2020, Mehdi Hajati, a former member of the Shiraz city council, was arrested for criticizing the government’s response on Twitter. His Twitter account was inaccessible following his arrest.178 Also in March, Mohammad Mokhtari, the captain of a local soccer team in Gilan, one of the provinces most affected by COVID-19, was arrested for Instagram posts in which he cast doubt on official data and denounced the authorities for the inadequacy of their health measures.179

Masoud Heydari and Hamid Haghjoo, the managing director and the Telegram channel administrator at the Iranian Labor News Agency (ILNA), were arrested in April 2020 following the alleged posting of a cartoon mocking unscientific COVID-19 remedies prescribed by Iran’s religious leaders.180 ILNA denied ever publishing the cartoon and said the two were falsely accused. Heydari was released on bail, while Haghjoo was detained pending an investigation.

Over the past several years, amid domestic political tensions between reformists and conservatives, hard-liners within the judiciary and the IRGC have conducted a campaign against the perceived “infiltration” of foreign ideas, individuals, and companies. Numerous foreigners or Iranians with dual nationality who were active in journalism, human rights work, or ICT development have been imprisoned by the authorities, often with little explanation.181 For example, Nazanin Zaghari-Ratcliffe, an Iranian-British dual citizen, was sentenced to five years in prison in 2016 for supposedly spying and designing websites that support sedition.182 She was released from house arrest in March 2020 following the completion of her sentence,183 but she faced new charges and was not permitted to leave the country. In April 2021, Zaghari-Ratcliffe was sentenced to another year of imprisonment and a one-year travel ban, according to her lawyer.184 She was found guilty of “involvement in propaganda activity against the Islamic Republic by “attending a demonstration outside the Iranian embassy in 2009 and speaking to BBC Persian.”

The legal status of encryption in Iran is somewhat ambiguous. Article 10, Chapter 2 of the CCL prohibits “concealing data, changing passwords, and/or encoding data that could deny access of authorized individuals to data, computer, and telecommunication systems.”185 While this could be understood to prohibit encryption, enforcement is not common. Nonetheless, authorities have periodically blocked encrypted traffic from entering the country through international gateways, particularly during contentious events such as elections.186

It was announced in April 2020 that the CDICC had drafted a regulation for creating “legal VPNs” and assigned the technical aspect of the plan to the ICT Ministry, though it had not been completed by the end of the coverage period (see B7). Under the plan, individuals will likely have to apply to purchase VPNs and secure approval from the government based on need, with factors potentially including one’s profession.

In August 2019, the SCC approved a new resolution entitled “Valid Identity System in Cyberspace.”187 The document calls for individuals to be assigned online identification, linked to their legal identification, that would be used for any online interaction. The system would be managed by the ICT Ministry. Should the resolution be fully implemented, it will give enhanced surveillance powers to the authorities and essentially make online anonymity impossible. Additionally, and in line with this resolution, the latest version of the “User Protection and Core Online Services” bill is designed to tighten regulations on foreign and domestic online services calls for users to have their identification verified according to their legal ID to be able to access online services.188 Though the bill has yet to pass at the end of the coverage period, it poses a threat to the security and anonymity of internet users inside Iran, especially human rights defenders and activists.

In January 2018, the ICT Ministry launched its mobile registry scheme. The program makes it illegal for service providers to connect unregistered mobile phones to the internet and was implemented to crack down on the smuggling of mobile phones into the country. In August 2018, the ICT minister announced a smuggling rate of zero.189 The program has led to concerns about users’ privacy.

The online sphere is heavily monitored by the state despite Article 37 of the nonbinding Citizens’ Rights Charter, which states that online privacy should be respected.190 In April 2018, supreme leader Khamenei issued a fatwa related to users’ privacy on social media and online messaging, saying, “the officials must safeguard the people’s and the country’s security and privacy. Invading the privacy and security of the people is religiously forbidden, and against the Islamic law and must not be undertaken.”191 However, the fatwa has not been enshrined into law. There are currently no comprehensive data-protection laws in place in the country.192

A draft bill on data protection and privacy was presented to the cabinet in July 2018 (see C2). However, as of May 2021, it had yet to be approved by the cabinet or the president, and had not been submitted to the parliament.193 The human rights group Article 19 has raised concerns about the content of the proposed bill, citing the lack of independence of the body that would implement the legislation, as well as “the lack of adequate remedies for individuals to counter violations of their rights, and to seek compensation for any damage suffered.”194 A report published by Small Media in April 2019 warned that if implemented, the draft data-protection bill, along with four other draft bills on related topics (see C2), could lead to even greater state control over and surveillance of internet users.195

The state monitors social media for activity it deems illegal. In May 2020, FATA announced that not wearing the hijab online would be considered a crime, and that those who do not follow this rule would be prosecuted (see C3).196

In November 2018, researchers at the Cisco Talos Intelligence Group warned that the Iranian “client” apps for Telegram, which allowed Iranian users to access the platform after it was banned (see B1), could grant the authorities access to all the information on a user’s phone.197 Google removed the two apps, Hotgram and Telegram Talaei, from its app store and users’ phones in April 2019, citing security and privacy concerns.198 The apps then shut down in June 2019 (see B2).199 In March 2020, it was reported that data from 42 million Iranian Telegram accounts had been leaked online,200 allegedly via Hotgram and Telegram Talaei.201 The two apps have been accused of links to the government and the Iranian hacker group Charming Kitten, which in turn is said to be connected to Iran’s intelligence services (see C8).202

In March 2020, Google removed Iran’s COVID-19 detection app, known as AC19, from the Google Play store. No official reasoning was provided (see B3). Iranian users raised concerns about the app’s security, as it collected geolocation data. However, a security expert who analyzed AC19 challenged claims that it was “a malicious Trojan or spyware.”203 The app remained available via domestic app stores and its own website.

State agencies such as the IRGC have pressured or coerced detained activists into handing over log-in details for their social media accounts, which the authorities have then used for surveillance and phishing attacks. This seems to be part of a broader pattern, as a number of activists have reported phishing attempts that were apparently sponsored by the government.204 According to a report published by the Center for Human Rights in Iran in May 2019, the government still employs malware to target certain groups both within and outside the country in order to gather private information. Victims of malware attacks include Gonabadi dervishes, ethnic Azerbaijani dissidents, women’s rights activists, and student activists (see C8).205

It remains unclear how thoroughly Iranian authorities can monitor the content of messages on foreign social media platforms, given that some apps encrypt their messages. However, all platforms and content hosted in Iran are subject to arbitrary requests by various authorities to provide more information on their users. Local platforms do not guarantee the kind of user protection offered by some of their international counterparts, which may explain their lack of popularity.

However, since the 2018 ban on Telegram, the government has promoted domestic messaging apps such as Soroush and Bale, including through financial and technological support. There are plans to incorporate these apps into e-government schemes, which would provide government and banking services exclusively through domestic messaging platforms. In 2021, appointments to receive Iran’s COVID-19 vaccine (known as COVIran Barekat) could be booked by phone or through the messaging app iGap, which has ties to the government.206 The potential rise of these apps, which work closely with authorities, could further jeopardize the privacy rights of users.207

In 2017, the SCC released a new resolution outlining a legal framework for messaging apps operating in Iran and formalizing previous demands that foreign messaging apps work with Iranian authorities to obtain licenses and move their data centers inside Iran. The rules also tasked the ICT Ministry with forming a committee to suggest a licensing process for domestic and foreign messaging apps.208 In line with the SCC regulations, the “cyber faction” of the parliament—an informal coalition of lawmakers—introduced a new draft bill on the topic in 2018,209 aiming to increase the user base and enforce the use of domestic messaging apps and restrict competition from foreign equivalents such as WhatsApp and Telegram.210 The bill has gone through several changes since 2018. In its latest iteration the bill, which is now called “User Protection and Core Online Services,” would require foreign and domestic online services to register with a supervisory board. Furthermore, foreign social media and messaging companies would have to “designate an Iranian company as their legal representative and to agree to abide by rules set by the regulator” (see B3).211 The legislation had yet to be passed at the end of the coverage period.

In 2020, the South African telecommunications company MTN released its first transparency report, indicating that in 2019 it had received 77,109 requests for location data and numbers identifying specific mobile devices, 77,400 data requests pursuant to criminal investigations, and 69,730 data requests pursuant to service suspension or restriction orders from Iran’s judiciary—some of the highest figures for any country covered in the report.212 MTN has been operating in Iran since 2006 in a joint venture with Irancell, and has about 46.8 million subscribers in the country.

Extralegal intimidation and violence by state authorities is common in Iran. Journalists, bloggers, and activists who are serving prison sentences due to their online activities frequently experience maltreatment and even torture while in detention.

Among other recent cases of abuse, online activist Abdulghafour Ghaderi was arrested in February 2021 after authorities identified him on social media. According to The Baloch Activists Campaign (BAC), Ghaderi was allegedly subjected to physical and mental torture following his arrest. He was accused of “spreading propaganda against the state, the disruption of public order, and supporting Baloch political groups.”213

In October 2020, Farangis Mazloom, the mother of jailed photojournalist Soheil Arabi, was sentenced to 18 months in prison for posting on social media about her son’s condition behind bars, which included being moved between prisons, placed in solitary confinement for long periods, injured, and tortured.214 Arabi, who was arrested in 2013 and eventually sentenced to seven and a half years in prison for spreading “propaganda against the state” and “insulting the supreme leader,” went on a hunger strike for more than 20 days in July 2019 to protest prison conditions and mistreatment by the authorities.215 He announced that he was going on another hunger strike in April 2020, again in protest of abusive prison conditions and denial of medical care.216

In August 2020 it was reported that the health of political prisoner Samaneh Norouz Moradi, who was serving a sentence of three years and nine months for “supporting antigovernment groups through online activities,” was declining. Doctors confirmed that she was unfit to serve her sentence, but staff at Evin prison disagreed, meaning her case was not recommended for review.217

Fatameh Khishvand, the Instagram celebrity known as Sahar Tabar, was arrested in October 2019 as part of a crackdown on popular Instagram profiles (see C3).218 She was coerced into giving a statement following her arrest, which was aired on television. According to Khishvand’s lawyer, she contracted COVID-19 while in prison during 2020 and was placed on a ventilator in a Tehran hospital. Her lawyer’s request that she be released on bail was denied several times, despite the fact that some other prisoners of conscience had been temporarily released since the COVID-19 outbreak began.219

Harassment and intimidation short of imprisonment is common. In January 2019, a number of Iranian Instagram influencers announced that they would wear tighter hijabs in their posts and deleted older pictures with less conservative hijabs or no hijab at all (see B2). FATA had reportedly threatened to suspend the influencers’ profiles if this content was not removed within a week.220

A survey of LGBT+ Iranians conducted by Small Media in early 2018 found that half had experienced online harassment, while one in five reported being entrapped by state or nonstate actors on dating apps.221 This is part of a long-term campaign of harassment against LGBT+ people.222 Article 19 also identified numerous cases of online harassment against LGBT+ people in a February 2018 report.223

In July 2018, lawyer Payam Derafshan claimed that 10 of his clients in Isfahan were summoned to court and asked to move their Telegram channels to the domestic messaging app Soroush. The administrators had reportedly received text messages from a security agency noting that their activities on Telegram were illegal.224

State hackers often launch cyberattacks against activists and campaigners, including those in the diaspora. Due to growing tensions among the governments of Iran, neighboring countries, and the United States, there has been a notable rise in reported hacking campaigns and cyberattacks affecting Iranians.

In February 2021, it was reported that the security company Bitdefender and the radio program Argos had identified a server in a Dutch data center that was being used by the Iranian regime to “spy on political opponents” in countries such as Germany, the Netherlands, India, and Sweden.225 The server was said to have been a command-and-control unit that could be used to steal and manipulate data from computers infected with malware.

The human rights organization Miaan Group reported in September 2020 that it had identified a malware program that was spread via malicious emails beginning in February 2018, initially targeting the Gonabadi dervishes, a persecuted Sufi religious group in Iran.226 The malware was traced to further attacks in June 2020 and linked to Andromedaa, a private technology firm in Iran’s northeastern city of Mashhad. According to Miaan, Andromedaa “had a pattern of attacking activists, ethnic minority groups and separatist opposition groups” as well as “developing phishing and malware tools that could target the general public” with the goal of “stealing information from opposition groups in Europe and the United States” and “spying on Iranians who often use mobile applications to plan protests.”227 The researchers also identified emails sent to various targets, including human rights organizations and journalists, that contained spyware enabling the attackers to access “almost any file, log clipboard data, take screenshots and steal information.”228

In January 2020, Certfa Lab reported a series of new phishing attacks from the Iranian hacker group known as Charming Kitten, which was believed to be affiliated with Iran’s intelligence services.229 According to the report, journalists as well as political and human rights activists were targeted in the attacks.

A separate report published by the Center for Human Rights in Iran in May 2019 found that the Gonabadi dervish website Majzooban had suffered state-sponsored distributed denial-of-service (DDoS) attacks that rendered it inaccessible for hours.230

In March 2021, a hacker group known as Tapandegan hacked and defaced the website of the Ministry of Economic Affairs and Finance. The group reportedly claimed to have acquired “confidential” financial information, though these claims had not been verified at the end of the coverage period.231

In February 2020, Iran experienced extensive network disruptions that the government attributed to a DDoS attack originating outside the country, though officials did not provide more information to verify this claim.232 The disruption could have been caused by the introduction of a new Internet Exchange Point (IXP) during the same period. In November 2018, ICT Minister Azari-Jahromi claimed that the Israeli firm Internet Gold Golden Lines had launched a series of cyberattacks on Iran’s network infrastructure that were neutralized by Iranian agencies.233