Internet penetration, bandwidth, and speeds have slowly improved in recent years due to government investment in ICTs. However, the expansion of the National Information Network (NIN)—the country’s domestic internet architecture—has enabled the regime to deliberately restrict internet access (see A3).

Internet penetration stood at 78.6 percent and there were 126.9 million mobile connections in Iran as of January 2023.1 Fixed-line broadband connections are relatively slow compared to mobile offerings. As of May 2023, the median mobile and fixed-line broadband download speeds were 35.68 megabits per second (Mbps) and 12.60 Mbps, respectively.2

In February 2020, the Supreme Council of Cyberspace (SCC), Iran’s top internet policymaking body, began dedicated meetings to set five-year targets for the expansion of the NIN (see A3).3 Several NIN-related infrastructure projects and investments have been announced in recent years, demonstrating that, despite economic difficulties,4 authorities remain committed to developing the network.

Since President Ebrahim Raisi came to power in 2021, the ICT Ministry made the development of the NIN, which will reduce Iran’s dependence on the global internet, a main priority.5 In February 2023, the National Center for Cyberspace (NCC) announced that 86 percent of the NIN’s operational goals have been met, and said that investments in fiber-optic infrastructure and long-term evolution (LTE) mobile networks would continue.6 However, statistics related to NIN progress have been disputed in the past.7 In April 2023, the ICT minister announced that the NIN should be completed by the end of the year.8

The creation of a new working group dedicated to satellite-based internet service at the NCC was announced in February 2021.9 However the use of satellite internet in the form of very small aperture technology (VSAT) is only used by state-regulated and -licensed internet service providers (ISPs) like Pars Online.10 In June 2023, after the coverage period, authorities put out a general call to local companies to apply for satellite internet licenses with the Communication Regulatory Authority (CRA).11

During the coverage period, a clarification from the US Treasury Department on sanctions against Iran facilitated the export of noncommercial connectivity services, including cloud-based and satellite devices, to Iran.12 Starlink began providing satellite-based services shortly after the Woman, Life, Freedom protests broke out,13 reporting that nearly 100 Starlink terminals were operating in Iran as of December 2022.14 In May 2023, authorities filed a complaint with the Radio Regulations Board at the International Telecommunication Union (ITU), requesting that Starlink comply with the regime’s regulations and licensing requirements (see A4).15 In July 2023, after the coverage period, the board ruled that Starlink did not abide by local laws or regulations for want of a license.16

The government’s investment in ICT infrastructure through the NIN has somewhat reduced the urban-rural divide by increasing connectivity in rural areas, though pricing remains high.

Inflation and price increases in recent years have resulted in significantly higher costs for internet users. In April 2022, Iranian ISPs increased their prices between 60 and 100 percent, with some mobile service providers also scrapping their 6- and 12-month subscriptions in favor of more expensive 90-day packages.17

Users continue to rely on cheaper mobile internet packages over fixed-line broadband offerings.18 As of 2023, the cost of a monthly 112 gigabyte (GB) fixed-line broadband internet package is 2 million rials ($46.82).19 A four-month 15 megabyte (MB) mobile internet package costs 620,000 rials ($14.50).20 For comparison, Iran’s gross national income (GNI) per capita was $18,130 in 2022 according to the World Bank.21

Under a 2017 bandwidth pricing policy, internationally routed traffic—downloads or uploads of global internet content—is priced at a higher rate than domestically hosted websites (through the NIN) and other government-approved content (see B7).22 This policy also discourages the use of VPNs by making them more expensive.23

Despite improvements to access, inequalities persist. Specifically, some rural provinces, which are often inhabited by ethnic minorities, have poorer access than urban areas. In April 2023, the ICT minister announced that the NIN had connected 3,425 rural villages across Iran.24

To help bridge the socioeconomic gap in access, in July 2022, the government announced that it would provide 30 GB of free internet to lower-income households.25

Score Change: The score declined from 1 to 0 because Iranian authorities cut or otherwise disrupted connectivity in response to antigovernment protests that began in September 2022, and continued to do so intermittently throughout the coverage period.

Localized internet shutdowns are often used to immobilize protests, to which authorities often respond with excessive force. Furthermore, Iran’s internet governance is highly centralized, which allows authorities to easily restrict connectivity.26

Beginning in September 2022, authorities implemented multiple localized and widespread internet shutdowns and mobile disruptions, in an effort to quell massive antigovernment protests sparked by the death in custody of Jina Mahsa Amini (see B8).27 Authorities also blocked access to WhatsApp and Instagram and filtered VPNs and proxy servers (see B1).28

Localized internet cuts began on September 16, 2022, in the areas surrounding Kasra Hospital in Tehran where protesters and mourners gathered as Amini’s death was announced.29 In the first month of protests, internet disruptions were reported in Kordestan and Khuzestan provinces, typically lasting for up to one day.30 Service restrictions and throttling were also observed when protests occurred in the provinces of Kordestan, Khuzestan, and Sistan and Baluchestan.31 Beginning in February 2023 and continuing through the end of the coverage period, authorities restricted internet service in several provinces every Friday, typically around protests following the day’s prayers.32 Weekly shutdowns in Sistan and Baluchestan continued to occur after the coverage period ended.33 Localized internet cuts also occurred in May 2023 amid protests caused by the execution of three men.34 For example, internet connectivity was throttled for most of the month in Yazd Province, while daily shutdowns, lasting for 8 hours, occurred in Esfahan Province.35

The internet shutdowns during the Woman, Life, Freedom protests reportedly resulted in $1.5 million worth of losses to the Iranian economy, according to the vice president of the Iran Chamber of Commerce.36 Due to the economic cost of fixed-line internet shutdowns, authorities took to largely disrupting mobile networks shortly after the protests broke out. On September 21, 2022, five days after the protests began, nationwide mobile restrictions, lasting approximately 12 hours, were imposed.37 According to Cloudflare data, daily mobile-connectivity curfews, often lasting for 8 hours, persisted nationwide from mid-September 2022 through the beginning of October.38 Additional mobile and localized internet restrictions continued throughout the coverage period, often coinciding with protests.39

Localized cuts and mobile restrictions are common in Iran. However, a nationwide near-total internet cut imposed in November 2019 lasted for seven days and affected both mobile and broadband connections across most of the country. The 2019 decision to disconnect the country from the global internet was made by the Supreme National Security Council (SNSC) following a wave of protests sparked by the sudden announcement of fuel-price increases.40 No prior notice was given to users, and no parliamentary approval was sought to extend the shutdown beyond its initial 24-hour period.41

Investigations from the Intercept and Citizen Lab published during the coverage period revealed that the Communication Regulatory Authority (CRA) was using SIAM technology to throttle mobile service on individuals’ phones.42 SIAM is a program that allows service providers to remotely manipulate and downgrade cellular connections at the CRA’s direction. SIAM has also reportedly been used by authorities to surveil individuals via geolocation data collected by mobile service providers (see C5).43

Outside of deliberate connectivity restrictions, users have reported a deterioration of the internet-service quality and bandwidth as authorities continue to build up the NIN and cut Iran off from the global internet. The Telecommunication Infrastructure Company (TIC) retains a monopoly on internet traffic flowing in and out of the country.44 In October 2021, local news agencies started reporting a shortage in international bandwidth due to the SCC’s refusal to grant new licenses to ISPs for international connections via the TIC, while previous licenses expired with no renewals.45

Through the NIN, authorities have been taking steps to roll out a “layered” or “tiered” internet structure, where specific groups of people will be able to access the international internet while the rest are left with the domestic network.46 Implementation would expand the government’s censorship and surveillance capabilities as much of the population would be forced to use domestic apps and platforms which offer weak privacy and security features (see C5).47

The IUPB, which was partially implemented during the coverage period, will further centralize Iran’s internet backbone under the government (see B3).48 Article 3 of the bill gives the Supreme Regulatory Commission (SRC), a body within the SCC, the power to set bandwidth limits and manage access to the international and domestic internet.49 Rights organizations, such as ARTICLE19, have expressed concern about the disproportionate impact the bill could have on marginalized populations like LGBT+ people, who heavily rely on the international internet to access information and connect with their community.50

The telecommunications industry is tightly controlled by the government. The TCI owns the Data and Communication Company (DCC), the country’s main ISP. The Mobile Telecommunication Company of Iran (MCI), a subsidiary of the TCI, is the largest mobile service provider.51 The second-largest mobile service provider, MTN Irancell, is owned by MTN, a South African telecommunications company, and Iran Electronics Industries, a state-owned subsidiary of the Defense Ministry.52

The CRA, which falls under the ICT Ministry, regulates the telecommunications sector and is responsible for issuing licenses to service providers. Telecommunications companies are required to register with the ICT Ministry and must comply with CRA rules and regulations. For example, all telecommunications providers must provide the CRA with direct access to their networks and comply with government censorship and surveillance requests (see C6).53

Iran’s telecommunications regulators are not independent. The SCC, which sets most internet-related policy, was established through a 2012 decree by the supreme leader; 17 members come from government institutions, while the supreme leader appoints 10.54 The SCC is meant to provide a centralized point for policymaking and the regulation of Iran’s virtual space, effectively minimizing the roles of the executive, legislative, and judicial branches and bringing internet policy under the supreme leader’s direct control. In February 2023, President Raisi appointed Seyyed Mohammad Amin Aghamiri as the new head of the SCC.55 In this role, Aghamiri will oversee projects related to e-governance, the NIN, and data protection.56

In the past, government officials routinely criticized the SCC for being disorganized,57 and for neglecting to encourage Iranians to use the internet in a “clean” and Islamic fashion.58 However, under former president Hassan Rouhani and under Raisi, the SCC has held meetings more frequently.

The CRA is responsible for regulating the telecommunications sector and its head is appointed by the ICT minister.59 Decisions pertaining to website blockings, internet cuts, and surveillance often lack transparency and accountability.60 In January 2023, the ICT minister made several changes to the Regulatory Commission at the CRA, such as removing a private-sector representative and including new members from the SCC, the Information Technology Organization, and Iran’s Post Services.61

The decisions to implement internet shutdowns have no clear legal framework and are considered “national security” decisions directed from the SNSC.62 However, there is much ambiguity over where decisions originate within the multiagency SNSC.63 Connectivity cuts are then implemented by the ICT Ministry, which oversees ISPs. Requests for copies of the SNSC’s shutdown orders have been refused in the past.64

Authorities restrict access to thousands of websites, particularly those of international news and information services,65 the political opposition, ethnic and religious minority groups in Iran, and human rights organizations.66 Websites are also blocked if they contradict state doctrine regarding Islam or government narratives on domestic or international politics. News stories that cover friction between Iranian political institutions are frequently censored.

Article 749 of the penal code requires all ISPs to filter any content determined by the Commission to Determine the Instances of Criminal Content (CDICC)—a government body headed by the prosecutor general that consists of representatives from 12 state institutions—to be criminal content. Resistance in complying with this article can result in the termination of the ISP or in some cases a financial penalty.67

The IUPB, parts of which were implemented during the coverage period, requires international technology companies to open offices within Iran and comply with Iranian authorities’ censorship requests or risk blocking (see B2 and B3).68

Twitter, TikTok, Facebook, and YouTube are all blocked or filtered, as are major blog-hosting platforms.69 The navigation app Waze and the messaging app Viber, which were developed in Israel, were first blocked in 2017 and 2014, respectively.70 In April 2018, a prosecutor in the Media Court issued an order to filter Telegram, resulting in the judiciary ordering the obstruction of the platform by ISPs and mobile service providers.71 The messaging app Signal was blocked in January 2021.72 In April 2021, the audio discussion app Clubhouse was blocked, without explanation, by Iranian providers.73

Instagram and WhatsApp, the only international platforms that remained accessible in Iran prior to September 2022, were blocked amid the nationwide Woman, Life, Freedom protests. The interior minister said the blocks were temporary measures to protect national security, but both remained blocked at the end of the coverage period.74 In December 2022, Meta was reportedly given a 10-day deadline to establish an office in Iran and cooperate with censorship and data sharing regulations if Instagram was to be unblocked (see B2).75 Meta did not comply with the order.76

Other foreign platforms including video gaming software, Skype, and LinkedIn were blocked or filtered during the coverage period.77 The Google Play store and Apple’s app store were filtered in September 2022. After a month of filtering, authorities unfiltered the Apple app store, LinkedIn, and Skype.78 As of June 2023, Google Play remains blocked.79 Over 90 percent of mobile phone users in Iran use devices powered by Google’s Android operating system.80

LGBT+ content online is routinely blocked. A 2021 report on LGBT+ online censorship from the Open Observatory for Network Interference found that 75 unique LGBT+ URLs have been blocked in Iran.81

Domestic news sites are frequently blocked for criticizing the government. In March 2022, the reformist Emtedad news outlet was blocked per a decision by the CDICC. According to some reports, the website did not have a license from the Culture Ministry,82 but the outlet’s chief editor claimed they had been given no prior notice about the action. Anar Press and Aban Press were blocked after the chief editor of both sites was arrested in April 2019.83

Authorities employ a centralized filtering system that can effectively block a website within a few hours across the entire network. Private ISPs are forced to either use the bandwidth provided by the government or route traffic containing site-visit requests through government-issued filtering boxes developed by software companies within Iran. The filtering boxes inspect URL requests submitted by users for banned text strings—either keywords or domain names—and block access accordingly. This method only limits access to content retrieved through unencrypted Hypertext Transfer Protocol (HTTP) connections. Individual pages remain available via encrypted HTTPS connections, which disguise banned text, requiring censors to block the entire site in order to restrict access to specific content.84

Many Iranians rely on VPNs to access international services and content blocked by authorities. However, the regime began blocking various proxy servers and VPNs amid the Woman, Life, Freedom protests.85 In October 2022, lawmakers announced that the ICT Ministry would be responsible for blocking unauthorized VPNs and that users could face criminal penalties for their VPN usage (see C2).86 This development is in line with a long-term policy of forcing Iranians onto domestic services and platforms and restricting the use of VPNs while the government works on rolling out its own approved VPN scheme (see B7).87

Authorities frequently employ administrative measures to force the removal of legitimate online content.

Website owners must register their sites with the Culture Ministry and are then subject to requests to remove posts deemed unacceptable by the government (see B6).88 The 2009 Computer Crimes Law (CCL) makes content hosts responsible for any content that appears on their sites.89 This has led to the suspension of blogs and the shuttering of news sites hosted on platforms inside Iran.

Under an August 2019 order, internet hosting companies inside the country are banned from providing services to filtered websites and can face prosecution for doing so.90 The affected sites include those carrying news and information about human rights or other politically relevant content, which are forced to rely on international hosting companies or shut down entirely.

The IUPB, parts of which were quietly enacted during the coverage period, requires foreign and domestic online platforms to register with a supervisory board and comply with Iranian content removal laws or face penalties, including blocking or throttling, or be replaced with “domestic alternatives” (see B6).91 The bill would make companies responsible for removing content deemed inappropriate under Iranian law.92 The blocking of Instagram and WhatsApp followed provisions laid out in the bill (see B1).93

In December 2022, the NCC addressed a letter to Meta, asking it to remove Instagram content that was “inciting violence” and to cooperate with Iranian authorities (see B1).94 A Meta spokesperson announced it had no intention to cooperate with Tehran.95

During the coverage period, authorities coerced detainees, specifically those involved in nationwide protests, to remove content from their social media accounts. For example, in September 2022, musician Shervin Hajipour was arrested and authorities forced him to remove his song “Baraye” from his Instagram page, which had become an anthem during the Woman, Life, Freedom protests.96 The Islamic Revolutionary Guard Corps (IRGC) commonly arrests Telegram group administrators and coerces them to remove content or delete their channels (see C3).97 CDI

Authorities frequently request outlets to take down content, often providing no justification for the decisions. In November 2021, the CDICC ordered the removal of a poem dedicated to the victims of the November 2019 protests from Iranian websites.98 In May 2021, Aparat stated in a social media post that an interview with former Iranian president Mahmoud Ahmadinejad had been removed following an order from the Islamic Republic of Iran Broadcasting (IRIB), though it did not state the reason.99

According to the British Broadcasting Corporation (BBC), two Persian-language content moderators at Instagram claimed that they were offered bribes to delete the account of Masih Alinejad, a prominent US-based Iranian American activist, in May 2022.100 According to one of the moderators, they were approached by Iranian intelligence officials and asked to delete the account of Alinejad; US prosecutors said Alinejad was the target of a kidnapping plot in 2021, while federal authorities accused several people of orchestrating a plot to assassinate her in 2022 (see C7).

The CDICC is responsible for making censorship decisions, which are often arbitrary and lack transparency. Other bodies, such as the judiciary and the SNSC, have also ordered filtering decisions, such as the ban on Telegram (see B1).101 Such decisions are ostensibly based on the 2009 CCL, which outlines a broad range of banned content, from insulting religious figures and government officials to distributing pornographic content and using illegal circumvention tools.102

In January 2019, two parliamentarians who sat on the CDICC wrote to the parliament speaker to complain about the lack of regular commission meetings and question the legality of its attempts to hold online votes on the filtering of websites.103

During the coverage period, reports emerged that the SCC had quietly ushered in parts of the IUPB, bypassing the legislative process as the bill had not been approved by the parliament. In September 2022, the SCC announced that a 12-member commission, including members of the IRGC, the Intelligence Ministry, and the judiciary, had been given authority to regulate the online space (see A3). This new commission, known as the SRC, and its responsibilities were key provisions of the IUPB, and this announcement was seen as evidence that some provisions of the bill had been enacted.104

Decisions by social media companies to remove Iranian content at times lack transparency. During the May 2021 protests in Khuzestan, ARTICLE19 documented over 300 instances of users reporting their protest content was taken down by Meta.105 With the resurgence of protests in May and September 2022, Meta continued to remove protest-related content, especially any content with the hashtag “death to [supreme leader Ayatollah Ali] Khamenei.”106 Other complaints of the platform censoring dissident content without reason occurred during the coverage period.107

In October 2022, Meta’s Oversight Board took on an appeal for a Facebook takedown of Iranian protest content that used the Persian phrase “death to Khamenei.”108 The Oversight Board recommended that the content should be restored and the slogan “death to Khamenei” should no longer be considered “incitement to violence” in the context of the Woman, Life, Freedom protests.109 Meta later accepted the recommendation and stopped removing “death to Khamenei” content.

In late September 2022, as protests sparked by the death in custody of Jina Mahsa Amini began, the US Treasury Department issued a general license to allow software and communications tools to be exported outside of sanctions. Several platforms and services, including Google Maps and Google Meets, became accessible within Iran during the coverage period.110

Self-censorship among internet users has historically been extensive, particularly regarding political issues or government criticism. Many journalists and bloggers abandoned their online activities or used pseudonyms after the crackdown on 2009 protests linked to that year’s disputed presidential election, resulting in a noticeable reduction in the amount of original content produced by users. However, the Woman, Life, Freedom protests have ushered in an unprecedented level of critical speech, both online and offline, from activists, human rights defenders, and ordinary citizens.111

Beginning in September 2022 when nationwide antigovernment protests began, Iranians—many of whom had long refrained from criticizing the government—took to social media and other online platforms to condemn the death in custody of Jina Mahsa Amini, criticize the government’s crackdown on demonstrations, and call for regime change. For example, social media users spread the hashtag “death to the dictator” to call for an end to authoritarian rule.112 This kind of speech can result in severe punishment, including imprisonment or extralegal harassment (see C2).

Iranian women and members of marginalized communities also used the online space to advocate for their rights during the coverage period. Under the slogan “Woman, Life, Freedom,” Iranian women used social media to openly flout restrictive laws that undermine their rights. For example, numerous women shared photos or videos of themselves unveiled online, protesting the country’s mandatory hijab laws.113 Members of the LGBT+ community posted photos that celebrated same-sex relationships,114 an act that can be punishable by death in Iran.115

While Amini’s death and the resulting demonstrations sparked a wave of critical speech online, the risks facing those who participate in this online dissent remained incredibly high. In September 2022, for example, two LGBT+ activists were sentenced to death for activism that preceded the Woman, Life, Freedom protests,116 and multiple women were arrested for appearing in unveiled online photos or videos during the coverage period (see C3). In addition to the arrests, harassment, and executions carried out by the regime, Iran’s cyberpolice, known as FATA, have charged internet users with “insults and slander” or “spreading disinformation” for their protest-related online content.117 In December 2022, intelligence forces in Esfahan Province announced that 23 online activists had been arrested.118

Throughout the coverage period, authorities have threatened online users to refrain from promoting the protests online and passed or proposed restrictive legislation to further curtail online speech (see C2).119 In July 2023, after the coverage period, a draft Hijab and Chastity Bill (HCB) was introduced, which penalizes “internet celebrities” if they declare solidarity with the Woman, Life, Freedom protests.120 Furthermore, a UN report published in March 2023 found evidence that the regime was complicit in the deliberate mass poisoning of schoolgirls,121 many of whom had vocally objected to laws on women’s dress online and supported the Woman, Life, Freedom protests (see C7).122

Score Change: The score declined from 1 to 0 because the regime used its extensive network of “cyberbattalions” to manipulate public opinion, discredit journalists and activists, and draw attention away from its crackdown on nationwide protests.

The Iranian regime frequently partakes in media manipulation and counters online criticism through an extensive digital propaganda apparatus. The media environment is tightly controlled by the state, and the IRIB serves as a vehicle for state-sponsored content manipulation.123 The Twitter account of state-affiliated Iran Newspaper, which has over 147,000 followers, frequently posts false or misleading information that paints the regime in a positive light.124 Progovernment online media outlets frequently spread hateful disinformation about Iran’s minority communities, including Baha’is, Kurds, and Iranian Arabs. In August 2022, state-media outlets falsely asserted that four suspected members of a Kurdish political party were “Israel-affiliated terrorists.”125

The regime has a long history of manipulating content, both online and offline, which has increased with the rise of social media.126 The state has sponsored networks of inauthentic social media accounts to spread propaganda, and has openly boasted about its “cyberbattalions,” which are active in pushing progovernment narratives on Twitter.127 In the first few weeks of the Woman, Life, Freedom protests, authorities sought to use their extensive disinformation networks to portray the protests as a separatist revolt rather than a popular uprising. For example, inauthentic social media accounts amplified progovernment disinformation such as news articles and videos falsely linking Kurdish armed groups (such as the Peshmerga) to the demonstrations. In another case, videos circulated online showed Iranian security forces, who were dressed as Peshmerga combatants, assaulting and harassing people in Iran’s Kurdish cities.128

During the coverage period, the regime allegedly spread disinformation to distract online users from the state’s violent crackdown on nationwide protests. In January 2023, an anonymous Twitter account impersonating an opposition activist known as Jupyter Rad spread progovernment propaganda to its followers, who numbered over 100,000.129 Specifically, the account claimed that Judge Abdolqassem Salavati, a notorious figure known to most Iranians as the “hanging judge” because of the number of death sentences he has handed out, was assassinated.130 This deliberately false news went viral and quickly overtook Persian-language social media sites, temporarily quelling reporting on the protest crackdowns and executions. Many analysts believe Jupyter Rad is a regime-run troll account that is used to distract the public through its disinformation campaigns.131

Progovernment troll networks have also infiltrated antigovernment social media campaigns by flooding protest-related hashtags with propaganda and disinformation.132 In January 2023, Twitter and Instagram blocked the Persian hashtag "do execute” after regime supporters and government actors used it to spread disinformation and promote the executions of protesters.133

The regime has backed numerous initiatives to promote blogging among its supporters.134 For example, an Iranian Cultural Center has sponsored the annual National Cyber Jihad Festival for bloggers to promote conservative religious values online.135 Authorities also actively support the creation of state-sanctioned social networking sites and mobile apps by offering free bandwidth and hosting to local developers.136

Government actors and private companies alike spend thousands of dollars on social media manipulation.137 In August 2022, reports revealed that the Mobarakeh Steel Company had spent 4.1 billion rials ($96,000) on a cohort of Twitter users to reshape the narrative around a pending parliamentary inquiry into a corruption case against it.138

Telegram channels affiliated with the IRGC, the Basij paramilitary group, and the Ministry of Intelligence have been active in many different information operations to skew coverage of the Woman, Life, Freedom protests.139 Certain Telegram channels, some of which are reportedly affiliated with security forces, such as Bisimchi Media, disseminate videos that push progovernment narratives relating to the protests.140 The IRGC similarly uses state-owned media to spread disinformation online, in part by regularly misrepresenting European and US commentators as supporters of Tehran’s policies.141 The IRGC’s “cyberheadquarters” employs around 45,000 people who are reportedly tasked with praising the IRGC and government policies.142 In September 2021, Meta removed a network of inauthentic accounts involved in a domestic influence operation, primarily targeting users in the Lorestan region. The network, which was found to be linked to the IRGC, posted criticism of the United States, Saudi Arabia, and the Kurdish nationalist movement.143

The regime issues statements, that are then circulated online, that deliberately mislead the public or discredit government critics. For example, shortly after the Woman, Life, Freedom protests broke out, the Ministry of Intelligence and the IRGC shared a false statement accusing two recently detained journalists of collaborating with the US Central Intelligence Agency on their protest-related journalism.144

News sites and journalists are consistently warned against covering sensitive political or social topics.145 Ahead of the June 2021 presidential election, a number of journalists received judicial warnings about election coverage, with some reporting harassment from FATA and the IRGC’s cyberunit, according to the International Federation of Journalists.146 During the November 2019 protests, journalists and media outlets were issued official guidelines from the Intelligence Ministry and the Culture and Islamic Guidance Ministry on how to cover the news.147 They were threatened with criminal prosecution if they strayed from the ministries’ instructions, which required outlets to portray the demonstrations as civil protests or “turbulence,” without mentioning the extent or violence of security forces’ response.148

There are several regulatory and economic constraints that affect the ability of users to publish online.

Domestic internet traffic is priced at a lower rate compared to international traffic, ending net neutrality, and making it more costly for users to access international platforms.149 Efforts towards implementing a “tiered” internet could allow authorities to determine who gets access to the global internet and who will be forced to rely on the highly censored domestic web (see A3). For example, in January 2023, the ICT minister announced that “preferential access” to international content may be provided to freelancers, developers, and academics.150

The IUPB, parts of which were quietly enacted during the coverage period, requires foreign and domestic online platforms to register with a supervisory board and comply with Iranian laws or face penalties (see B3).151 It also requires that foreign companies open offices within Iran. Meanwhile, Iranian versions of popular social media apps, such as Bale, Rubika, and Soroush, receive significant financial support from the government as it continues to push users away from the international internet and onto these domestic apps.152

In January 2020, a notice signed by then chief justice Ebrahim Raisi was sent to regional judiciary officers, stating that the IRIB is responsible for issuing licenses and regulations relating to audio and video content online.153 In January 2023, the government announced that all online platforms that publish audio or visual content, including online, must receive a license from the Audio Visual Regulatory Authority.154 Platforms without a license will not be permitted to publish content.155

Onerous regulations that require compliance with Iranian content removal legislation have forced several websites and platforms to shutter under the weight of fines and lawsuits. In 2017, Iran’s oldest local social media platform, Cloob, announced it was closing, as it could no longer keep up with the government lawsuits and requests to remove content.156

US sanctions have historically prohibited US technology companies from operating in Iran, though these sanctions were loosened during the coverage period (see B6).157

According to October 2022 research by the Tehran Computer Trade Union Organization, online businesses lost more than 50 percent of their income during the first month of the Woman, Life, Freedom protests due to online restrictions and connectivity disruptions.158

By splitting domestic and international traffic, ending net neutrality in the country, and creating price incentives for users to browse domestic content, the Iranian regime has created barriers to media diversity and innovation.159 Furthermore, the regime’s efforts to push Iranians onto the highly censored domestic internet will significantly limit the diversity of content available to online users.160

The media landscape is tightly controlled by the regime and there are very few independent or critical media outlets.161 Online users must rely on international media for accurate and objective news, though extensive censorship has essentially prohibited Iranians from accessing these types of platforms (see B1). Before its blocking, Instagram was often used as a news source, a platform for activism, or to discuss politics (see B1).162 Independent journalists and bloggers are frequently jailed for their reporting, further hindering the diversity of content available online.

Aparat, an Iranian website similar to YouTube that enjoys less expensive tariff rates, is one of the most visited websites in Iran.163 Content on Aparat is governed in accordance with Iranian law, making it difficult for users to share or access socially or politically sensitive views. Internet hosting companies inside Iran are banned from providing services to filtered websites under threat of prosecution (see B2).164

VPNs are commonly used to protect online privacy and to circumvent the government’s filtering; their availability has been a topic of debate among politicians for some time.165 However, the government regularly seeks to disrupt access to VPNs and has made efforts to establish a “legal VPN” scheme to control access to these tools. 166 Individuals will likely need to apply to purchase VPNs and secure approval from the government to gain access to the global internet in the future (see C4).167 The “legal VPN” scheme had not been implemented by the end of the coverage period.

Online diversity is severely restricted by extensive website blocking and financial constraints. Nearly all international news sites are blocked, as are websites that host content about LGBT+ rights and religious minorities (see B1).168 Furthermore, internet shutdowns are more commonly ordered in Kurdish-majority provinces than other parts of Iran (see A3).

Despite formal blocks on major international platforms, social media plays an important role in allowing dissidents to pursue online campaigns and share information. While Instagram and WhatsApp were blocked during this reporting period (see B1), they remained central to the nationwide protests. Social media networks such as 1500Tasvir, Vahid Online, and Black Fish Voice were also central to the documentation and dissemination of information during the Woman, Life, Freedom protests.169

Social media platforms were integral to organizing those protests and documenting the violent crackdown on protesters at the hands of security forces. Within the first two weeks of the protests, #MahsaAmini trended on social media, reaching 160 million posts.170 During the coverage period, social media was used to campaign against the executions of protesters under the hashtag “do not execute.” A surge in online campaigning for LGBT+ rights was also seen.171 These campaigns and online mobilization efforts often resulted in heavy-handed retaliation from authorities.

Bandwidth throttling and internet cuts are common during politically sensitive times and used to crush protests and disrupt the documentation of human rights violations.172 Localized internet shutdowns and mobile restrictions began in September 2022 amid nationwide protests and continued through the end of the coverage period (see A3). In November 2019, a nationwide internet cut was implemented during fuel-price protests.

During the coverage period, authorities arrested social media users because of their participation in online mobilization initiatives (see C3). For example, women in Iran have taken to social media to protest the country’s strict hijab laws by posting videos of themselves taking off their hijabs. Several activists were arrested after participating in the “no to mandatory hijab” social media campaign in July 2022.173 In July 2023, after the coverage period, a draft HCB was introduced, which includes heavy fines for “internet celebrities” if they declare solidarity with the Woman, Life, Freedom protests.174

University students and younger schoolgirls became vocal supporters of the protests, often using social media to show solidarity with protesters or condemn the country’s strict hijab laws. In response, authorities from the Ministry of Science and the Ministry of Health enacted new policies to curtail the online activities of university students. Specifically, students will need authorization to form “virtual groups” with more than 100 people or face penalties including suspension or expulsion.175 Authorities further targeted high school and university students with physical violence, criminal penalties, and surveillance in retaliation for their protest-related online activities during the coverage period (see C7).176

In addition to government actions, international platforms’ content moderation policies have also impacted online movements in Iran (see B3). In May 2022, Instagram users reported that protest-related was removed by the platform. These removals also affected the accounts of the London-based Persian news channel Iran International and the popular account 1500Tasvir.177 This trend continued during the Woman, Life, Freedom protests, with users reporting takedowns of their social media posts (see B3).

The 1979 constitution and legal framework do not protect freedom of expression and press freedom online. The head of the judiciary is appointed by the supreme leader, and the courts in general lack independence.

Overly broad and vague restrictions exist in the constitutional framework and in the Islamic penal code, neither of which comply with international human rights law (see C2).178 Article 24 of the constitution guarantees the right to freedom of expression, yet it broadly provides for the restriction of expression deemed to infringe upon “the basic tenets of Islam or public rights.”179 Other constitutional provisions further undermine the already-weak constitutional guarantee of freedom of expression, enabling broad limitations to be routinely imposed by authorities.180

Media freedom, while technically protected under Article 40 of the constitution, is subject to restrictions.181 The media is further regulated through the 2002 Press Law, which continues to significantly obstruct independent media from operating and is used to deny access to independent, pluralistic, and diverse sources of information.182

In July 2021, Khamenei appointed deputy judiciary chief Gholamhossein Mohseni Ejei to lead the judiciary, after his predecessor, Ebrahim Raisi, was elected president that June.183 Raisi’s past role as a member of Tehran’s “death commission,” responsible for the executions of thousands of political prisoners in 1988, stoked strong opposition to his presidential appointment from international human rights groups.184

In response to the nationwide protests following the death in custody of Jina Mahsa Amini, authorities have adopted a range of repressive legislative and policy measures that would further violate freedom of expression in Iran (see C2).185

Numerous laws tightly restrict online speech and allow harsh punishments for those who deliberately flout the constraints or inadvertently draw the ire of authorities. The Press Law, for example, forbids the publication of ideas that are contrary to Islamic principles or detrimental to public rights, none of which are clearly defined.186 The government and judiciary regularly invoke this and other vaguely worded legislation to criminalize offline and online criticism of the regime.

The 2009 CCL outlines punishments for spying, hacking, piracy, phishing, libel, and publishing materials deemed to damage “public morality” or result in the “dissemination of lies.”187 Punishments are severe and include the death penalty for offenses against public morality and chastity, as well as long prison sentences, draconian fines, and other penalties for service providers that fail to enforce government content restrictions.188

The repressive penal code also applies to online activities.189 Article 286, which relates to the crime of efsad-e fel arz (“sowing corruption on earth”), is punishable by death. Efsad-e fel arz includes a set of ill-defined acts, such as “spreading lies,” the “disruption of the economic system,” and actions that cause “severe disruption in the public order of the state and insecurity.”190

In January 2021, the SCC ratified the “Document on Preventing and Combating the Dissemination of Misinformation and Fake News and Content,” which seeks to establish a legal framework in collaboration with a number of ministries and the judiciary to address what it refers to as “fake news” in online spaces.191 Its scope could also encourage more self-censorship by the press and online users who wish to avoid prosecution (see B4). In September 2022, the IRGC called for the prosecution of those who spread “false news and rumors” amid massive antigovernment protests.192 A new bill that had not been ratified by the end of the coverage period includes amendments to the penal code that criminalize the spread of information deemed to have “negative social consequences.”193 If enacted, those found guilty of sharing such content could face up to 15 years in prison.194

In August 2023, after the coverage period, lawmakers proposed the HCB, which considers the act of appearing in public without a hijab, whether in person or online, as harmful to society. The bill introduces a range of punishments, including monetary fines, restrictions on accessing bank accounts, travel limitations, bans on online activity, and imprisonment. The bill aims to further restrict the online activities of influencers and celebrities who appear unveiled by labelling their activities as “crimes of national security.”195

Ongoing efforts to curb the use of VPNs include criminal penalties for those found to sell or use illegal circumvention tools. In October 2022, the ICT Ministry announced that anyone selling or using illegal VPNs could be charged under Article 753 of the penal code and could face fines or imprisonment (see B1).196

Score Change: The score declined from 1 to 0 because more people were arrested for their protest-related online activity than in recent years, and several executions were carried out against individuals in part due to their online content.

The Iranian regime routinely arrests journalists and social media users for their online activities. Those affected in recent years have included prominent activists, Instagram celebrities, editors at independent news outlets, and citizen journalists associated with persecuted religious groups like the Gonabadi dervishes, who adhere to a form of Sufism, and Baha’is.197

The regime took draconian steps to penalize online users during the coverage period, and several people were sentenced to death or executed by the regime for their online content. In May 2023, two men were executed for their atheism-related Telegram content. Yousef Mehrdad and Sadrollah Fazeli Zare were sentenced to death after being charged with crimes including blasphemy and insulting Islam, based on Telegram channels they ran or contributed to that promoted atheism.198 In September 2022, two LGBT+ activists, Zahra Sedighi Hamadani and Elham Choubdar, were charged with efsad-e fel arz and sentenced to death in retaliation for their online activism.199 Hamedani ran an LGBT+ Telegram channel and both were active on Instagram.200 Choubdar’s sentence was overturned in March 2023, and she was later released on bail. Similarly, in May 2023, Hamadani’s sentence was overturned and she was released on bail.201

Two musicians and online activists, Toomaj Salehi and Saman Yassin, were arrested in October 2022 in response to their social media content. Salehi was charged with crimes that are punishable by death, including “propagandistic activity against the government” after posting music videos to Instagram that supported the antigovernment protests.202 Salehi was reportedly held in solitary confinement for 252 days before standing trial, where he received a prison sentence of six years and three months in July 2023, after the coverage period. Yassin, a Kurdish musician, was sentenced to death for “waging war against god” after sharing songs online that supported the protest movement.203 He remains in pretrial detention in Rajai Shahr prison, where he has reportedly suffered physical and psychological torture (see C7).204

Several bloggers and social media users received harsh prison sentences for their online content, often that which was supportive of the Amini protests. In January 2023, two bloggers, Astiyazh Haghighi and Amir Mohammad Ahmadi, were each sentenced to over 10 years in prison after a video of them dancing in front of Tehran’s Azadi Tower went viral on social media.205 It is illegal for women to dance in public in Iran, and Haghighi was not wearing a head covering in the video. They were charged by a Tehran court with “encouraging corruption and public prostitution.”206 In December 2022, prominent blogger and internet freedom activist Amir Emad Mirmirani was sentenced to six years in prison for “assembly and collusion against national security” and “propaganda against the regime.” The sentence was likely related to Mirmirani’s social media content criticizing the regime’s decision to cut access to the internet amid protests (see A3).207

Journalists were arrested for their coverage of Amini’s death, some of whom remained in detention at the end of the coverage period. Journalist Niloofar Hamedi, who was arrested in September 2022 after posting a photo of Amini’s parents embracing each other upon receiving news of their daughter’s death, remained in detention as of June 2023.208 Hamedi, along with Elaheh Mohammadi, another journalist covering the Amini’s death, stood trial in May 2023. Both women, who were still awaiting verdicts at the end of the coverage period, face charges including conspiracy and collusion for their coverage of Amini’s death.209 Elnaz Mohammadi, a journalist and Elaheh’s twin sister, was handed a three-year suspended sentence in September 2023, after the coverage period, for reporting on the protests.210 In July 2023, after the coverage period, the editor in chief of Etemad was arrested for covering the protests.211

Several women were arrested for posting photos or videos of themselves unveiled online. In September 2022, Donya Rad was arrested after sharing a photo of herself dining in public without the hijab on Twitter.212 Iranian celebrity Taraneh Alidoosti was arrested in December 2022 after she posted a photo of herself unveiled to Instagram with the slogan “Woman, Life, Freedom” in Kurdish.213 She was later released on bail in January 2023.214 In July 2023, after the coverage period, Leila Ziafar, a scientist and teacher, posted a photo of herself without the hijab on Twitter and was arrested shortly after by the IRGC. Security forces then published footage of her arrest on social media to dissuade other women from such online protests (see B4).215

Internet users were arrested prior to the Woman, Life, Freedom protests. In July 2022, activist Soori Babaei Chegini was arrested after participating in a “no to mandatory hijab” social media campaign. According to reports, she was arrested after posting a video online showing her taking off her hijab in protest of the country’s strict laws on dress. Eight security agents allegedly raided her home, confiscated her mobile phone, and threatened her children (see C7).216 In June 2022, Sepideh Rashno was arrested after a video of her arguing with another woman who was enforcing dress rules on a bus in Tehran went viral online.217 Rashno was later forced to appear on the national broadcaster, with visible signs of torture from her time in custody, confessing to crimes by reading a prewritten script.218

Prosecution of LGBT+ people over their online expression is prevalent and has increased over the years. In October 2022, Iran Wire reported that three openly transgender Instagram users were arrested and transferred to notorious Evin Prison in Tehran. The three had been targeted due to their social media posts, which Iranian authorities described as “flouting social and religious norms.”219 According to the Iran Prisoners Atlas project, they have since been released.

The legal status of encryption in Iran is somewhat ambiguous, with the CCL prohibiting “concealing data, changing passwords, and/or encoding data that could deny access of authorized individuals to data, computer, and telecommunication systems.”220 While this could be understood to prohibit encryption, enforcement of the provision is uncommon. Nonetheless, authorities have periodically blocked encrypted traffic from entering the country through international gateways, particularly during contentious events such as elections.221 Several encrypted messaging applications including Signal and WhatsApp are blocked in Iran (see B1).

In April 2020, the CDICC announced the drafting of a regulation for creating “legal VPNs” and assigned the technical aspect of the plan to the ICT Ministry, though the regulation had not been completed by the end of the coverage period. Under the plan, individuals will likely have to apply to purchase VPNs and secure approval from the government (see B7 and C2).222 This process could entail providing personal or identifying information.

In August 2019, the SCC approved a new resolution entitled “Valid Identity System in Cyberspace.”223 The document calls for individuals to be assigned verified online identification, linked to their legal identification, that would be used for any online interaction. The system was launched in 2021 and is managed by the ICT Ministry, giving enhanced surveillance powers to the authorities.224

The IUPB is designed to tighten regulations on foreign and domestic online services and includes provisions that would threaten online anonymity by banning unauthorized encrypted communication tools and VPNs (see B3).225 Specifically, internet users would have their identification verified according to their legal documents to be able to access online services.226 The bill, which has been partially enacted, could force users onto domestic platforms that lack encryption and essentially make anonymous communication impossible.

Iran’s National Mobile Registry Plan, which was implemented in 2017, requires user to register mobile devices with government agencies.227 Purchasing a SIM card requires real-name registration, and users must present their passport or identifying documents to purchase a SIM card in Iran.228

Score Change: The score declined from 1 to 0 due to reports that Iranian authorities use a variety of methods to intercept internet users’ data, access encrypted communications, and geographically track mobile users.

The online sphere is heavily monitored by the state despite Article 37 of the nonbinding Citizens’ Rights Charter, which states that online privacy should be respected.229 In April 2018, the supreme leader issued a fatwa related to users’ privacy on social media and online messaging, saying the invasion of privacy is against Islamic law.230 However, the fatwa has not been enshrined into law, and is not respected in practice.

While the extent of Iran’s surveillance capabilities has long been shrouded in mystery, investigations published during the coverage period from the Intercept and Citizen Lab found that government agencies, namely the CRA, have the ability to intercept, store, and analyze mobile user data for the purposes of surveillance.231 According to the reports, authorities can intercept mass mobile data—including geolocation data, voice and text messages, and data usage records—without the necessity of judicial or legal warrant.

Citizen Lab and the Intercept also found that SIAM software installed on Iranian ISP networks has allowed the CRA to monitor mobile users’ online activity. Specifically, SIAM can throttle individual’s mobile service (see A3), analyze telecommunications metadata, access the content of encrypted communications (see C4), and use geolocation tracking to identify individuals.232

State surveillance of online activity is in part facilitated by the NIN, which includes several National Data Centers that not only house telecommunications data within Iran but allow authorities to have unfettered access to the servers where this data is collected and stored (see C6).233

The state monitors social media for activity it deems illegal. FATA is tasked with, among other things, monitoring and tracking social media under the auspices of combatting cybercrime.234 The regime uses deep-packet inspection (DPI) technology as part of its extensive online filtering and surveillance apparatus (see B1).235 DPI tools allow authorities to filter online content while also analyzing browser history and communications.236 In the past, officials have admitted to monitoring the online posts of activists and protesters.237

In recent years authorities have promoted domestic social media and communications applications, which have been accused of having links to Iran’s intelligence services.238 According to rights organizations, a major concern surrounding these domestic messaging apps is the potential misuse of user data and surveillance by authorities.239 In March 2022, the ICT minister announced that security forces may be permitted to access user data from these apps with a warrant.240 According to New Lines magazine, managers of Rubika, one of Iran’s domestic messaging apps, have claimed that they use artificial intelligence (AI) to identify and remove content that is deemed “immoral” from the app, although these comments have not been verified.241

Amid the Woman, Life, Freedom protests, reports emerged that Iranian authorities were using AI-powered technology, including facial recognition, to identify and target protesters, specifically women violating the country’s hijab laws.242 In May 2020, FATA announced that not wearing the hijab online would be considered a crime, and that offenders would be prosecuted (see C3).243 The proposed HCB will likely increase social media monitoring or the use of facial-recognition technology for those appearing unveiled online (see C2).

Tehran has purchased surveillance technology from other authoritarian governments, including those of China and Russia. Several investigations have found that the IRGC has purchased facial recognition technology from Tiandy, a Chinese technology firm.244 In March 2023, the Wall Street Journal reported that the Russian government had sold Tehran technology that included “communication-surveillance” software.245

State agencies such as the IRGC have pressured or coerced detained activists into handing over log-in details for their social media accounts, which the authorities have then used for surveillance and phishing attacks (see C8).246 During the coverage period, the Committee to Protect Journalists (CPJ) documented 48 cases of journalists who had their devices seized and illegally searched while in detention. It was also discovered that authorities used consumer disk recovery software known as Disk Drill to recover deleted files and content from detainees’ devices.247

According to a report published by the Center for Human Rights in Iran in 2019, the government still employs malware to target certain groups both within and outside the country to gather private information. Victims of malware attacks include Gonabadi dervishes, ethnic Azerbaijani dissidents, women’s rights activists, and student activists (see C8).248

All service providers and platforms hosted in Iran are subject to arbitrary requests by various authorities to provide more information on their users.

Iran lacks a comprehensive data protection law. In May 2023, a committee within the ICT Ministry announced that a draft bill on data protection and privacy would be sent to the cabinet.249 A previous version of the draft bill was presented to the cabinet in July 2018, which received significant pushback from rights groups.250 ARTICLE19 had raised concerns about the proposed bill in 2019, citing the lack of independence of the body that would implement the legislation, as well as “the lack of adequate remedies for individuals to counter violations of their rights, and to seek compensation for any damage suffered.”251

The CRA, which sits under the ICT Ministry and is heavily controlled by Iran’s intelligence forces, enforces the use of surveillance and censorship equipment at the ISP level, and has the ability to access user data collected by ISPs (see A4).252 In October 2022, reporting from the Intercept found that the CRA was using SIAM, a web program for remotely manipulating cellular connections and conducting surveillance operations (see A3 and C5). Specifically, it was found that the CRA used SIAM technology to track users through data collected from their registered SIM cards.253

Long-term government policies and financial incentives aim to force Iranian users to migrate from international platforms to less secure domestic platforms and services, which do not guarantee the kind of user protection offered by some of their international counterparts.254 Since Telegram was banned in 2018, the government has promoted domestic, state-linked messaging apps such as Soroush and Bale.255

Iranian social media users have reported having their personal and user profile information taken from Instagram (prior to its blocking in September 2022) and transferred and replicated onto Rubino—a domestic version of Instagram and part of the state-affiliated app Rubika—without their consent or awareness.256 Despite promises of an investigation by FATA, it does not appear that the platform was held accountable.

During the coverage period, reports emerged that locally operated platforms for taxis or food-delivery services were used to collect and share user data with authorities, who then used geolocation data to identify and, in some cases, arrest protesters and activists.257 For example, geolocation data from Snapfood, a food-delivery application, was used by security agencies to arrest a photographer in October 2022.258

The partially enacted IUPB has concerning provisions around data protection and online privacy. The bill requires foreign and domestic online services to register with a supervisory board, and foreign social media and messaging companies would have to “designate an Iranian company as their legal representative” and would be forced to comply with “rules set by the regulator” which could include complying with government requests for user data (see B2 and B6).259

In 2017, the SCC released a new resolution outlining a legal framework for messaging apps operating in Iran and formalizing previous demands that foreign messaging apps work with Iranian authorities to obtain licenses and move their data centers inside Iran. The rules also tasked the ICT Ministry with forming a committee to suggest a licensing process for domestic and foreign messaging apps (see B6).260

A 2009 law requires ISPs to retain user data for at least three months.261 There are several national data centers in Iran, where domestic and local internet traffic and user data is stored (see C5).262 Authorities have unfettered access to these data storage centers, such as the Shahkar System, which is a data warehouse that stores mobile user data, and Shamsa, which is an interface that allows for the collection of bulk text and voice message records as well as internet protocol (IP) data.263

In 2020, South Africa’s MTN—which has been operating the MTN Irancell joint venture since 2006—released its first transparency report. According to the report, MTN had received 77,109 requests for location data and numbers identifying specific mobile devices, 77,400 data requests pursuant to criminal investigations, and 69,730 data requests pursuant to service suspension or restriction orders from Iran’s judiciary—some of the highest figures for any country covered in the report.264

Score Change: The score declined from 1 to 0 because the regime engaged in extralegal harassment, violence that led to fatalities, and mistreatment in detention—including rape and other forms of torture—to silence internet users amid nationwide protests.

Iranian authorities commonly engage in extralegal intimidation and violence. Journalists, bloggers, and activists who are serving prison sentences due to their online activities frequently experience maltreatment and even torture while in detention.

Hundreds of people have been killed at the hands of Iran’s security forces while participating in the Woman, Life, Freedom protests, including several prominent social media influencers. Hadis Najafi, a prominent TikToker who used social media to promote women’s rights, in Iran was shot and killed in September.265 Also in September, 16-year-old video blogger Sarina Esmaeilzadeh was beaten to death by security forces while participating in protests.266

Numerous reports of torture in detention emerged during the coverage period. Saman Yassin, a Kurdish musician and artist, faced physical and psychological torture while in detention following his arrest in October 2022 (see C3).267 According to a July 2023 report, Yassin has been subjected to unknown injections, forced unconsciousness, and forced hospitalization.268

In March 2023, the Office of the UN High Commissioner for Human Rights (OHCHR) expressed concern over the mass poisonings of over 1,200 schoolgirls across Iran. Iranian schoolgirls, including those who were poisoned, have been instrumental online activists during the protests, sharing images and videos on social media—some of which have gone viral—to protest the regime and the mandatory hijab law.269 The poisonings started in November 2022; UN experts believe the poisonings were deliberate attempts to silence those demanding accountability for human rights crimes or for supporting the ongoing protests.270

The families of protesters condemned to unjust death sentences over their protest activity have also received threats and harassment for using social media to call attention to these sentences.271 This is consistent with the authorities’ long-standing practice of intimidating, harassing, and persecuting those who speak out about human rights violations. The father of an executed prisoner said that security forces violently entered their home and confiscated their laptops and phones.272 Gohar Eshghi, the mother of Sattar Beheshti, a blogger who was killed under torture in prison, has made public claims that she and her family have been threatened by government agents, likely in response to her son’s online activism.273

Gender-based harassment online is common. In August 2021, several human rights organizations released statements condemning the continued online threats and harassment against women activists and journalists, both inside and outside the country.274 The policing of online spaces since the beginning of the Woman, Life, Freedom protests has put increasing pressure on female journalists and activists.

The LGBT+ community has historically been a primary target of persecution both offline and online. According to ongoing research by ARTICLE19 and Afsaneh Rigot, LGBT+ individuals are frequently targeted and entrapped on dating apps and social media platforms by state and nonstate actors.275 This is part of a long-term campaign of harassment against LGBT+ people.276

At times, the government reaches across borders to repress dissent. Masih Alinejad, a prominent campaigner against Iran’s mandatory hijab laws, has been subject to smear campaigns and harassment by the regime since 2013.277 Beginning in 2019, authorities have routinely arrested and harassed her family as a way to threaten Alinejad, who lives outside Iran, to stop her online activism.278 In July 2022, a man was arrested outside her New York City residence because he and three others were hired by the Iranian regime to assassinate her, according to the Federal Bureau of Investigation.279 In February 2023, British security agencies announced that the IRGC attempted 15 plots to kill or kidnap British or UK-based individuals, including staff of the London-based Iran International news outlet.280

State hackers often launch cyberattacks against activists and campaigners, including those in the diaspora. Charming Kitten, a cyberwarfare group affiliated with Tehran, launched several spear-phishing campaigns against activists and dissidents during the coverage period.281 According to Rest of World, distributed denial-of-service (DDoS) attacks targeted independent media outlets during the previous coverage period.282

During the coverage period, Human Rights Watch (HRW) and Amnesty International revealed that Charming Kitten targeted two HRW staff members and at least 18 other high-profile activists, journalists, researchers, and politicians working on regional issues with ongoing social engineering and credential phishing campaigns. These attacks were conducted through WhatsApp links sent between September and November 2022.283

Several cyberattacks on state infrastructure and media took place during the coverage period. In October 2022, the Iranian hacking group Black Reward stole information related to Iran’s nuclear activities after hacking into the email account of the country’s atomic energy organization. The cyberattack was allegedly done in solidarity with Woman, Life, Freedom protests.284 In October 2022, another group hacked into an email account affiliated with mobile service provider Ariantel and leaked documents connecting the regime to censorship and surveillance activities (see A3 and C5).285

Several “hacktivist” groups targeted state-media with cyberattacks, reportedly in solidarity with Woman, Life, Freedom protesters. For example, in May 2023, hackers struck the Foreign Ministry’s website. The website’s home page was defaced with crossed-out images of Supreme Leader Khamenei and President Raisi.286

In July 2021, a cyberattack on the Transport Ministry caused widespread disruption to train services. The entity behind the attack is not known.287 In October 2021, an attack on petrol stations disrupted payment systems and caused significant disruption across the country. It is unclear who was behind the attack.288

The New York Times identified malware spread via malicious emails beginning in February 2018, initially targeting the Gonabadi dervishes.289 The goal of these tools is to steal information from opposition groups and spy on Iranians who use mobile apps to organize protests.”290 A separate report published by the Center for Human Rights in Iran in May 2019 found that the Gonabadi dervish website Majzooban had suffered state-sponsored DDoS attacks that rendered it inaccessible for hours.291

Iran’s sophisticated cyberwarfare tactics have also been used to target dissidents abroad. In August 2023, after the coverage period, ARTICLE19 documented a series of leaks from the IRGC-affiliated Aadl Ali Telegram account, which revealed that the account operators had hacked into the devices and emails of several prominent members of the Iranian diaspora over several years, with the intention to embarrass and discredit them by publicly posting intimate and private recordings.292

Due to growing tensions between the governments of Iran, neighboring countries, and the United States, there has been a notable increase in foreign hacking campaigns and cyberattacks targeting Iranians. In June 2022, the hacking group Predatory Sparrow, carried out a cyberattack on an Iranian steel company, allegedly in response to “unspecified acts of "aggression" carried out by the Islamic Republic.” The attack, which resulted in a fire in the steel factory, is thought to have been carried out by a sophisticated, foreign, state-sponsored hacking group.293