The architecture of control
When Iranians open a browser, they do not see the same internet the rest of the world sees. Sites are unreachable, apps fail to connect, and pages load at speeds that would have felt slow in 2005. This is not accident. It is policy — a system Iranians call Filternet: a state-managed, deliberately degraded national network designed to keep dissent offline and surveillance built in.
The Supreme Council of Cyberspace, created by Ayatollah Khamenei in 2012, sits at the top of this architecture. Below it, the Telecommunication Infrastructure Company controls the country's international gateways, and the Ministry of Information and Communications Technology issues the licenses that every ISP needs to operate. Every packet leaving an Iranian device passes through chokepoints the state owns.
Eleven years of throttling
The throttling did not begin with Mahsa Amini. In the 2009 Green Movement, authorities slowed mobile data so that videos of Neda Agha-Soltan's death could not upload. In November 2019, during the fuel-price protests, the state cut the internet entirely for nearly a week — the longest nationwide blackout any country had ever imposed at the time. Amnesty International later documented at least 304 killings during that blackout, in cities the outside world could not see.
After 2019, throttling became routine. WhatsApp was crippled, then blocked. Instagram, the last major Western platform tolerated by the regime, was banned in September 2022 when Woman, Life, Freedom protests broke out. By 2024, Signal, Telegram, Twitter, YouTube, Facebook, TikTok, Reddit, Twitch and most of the modern web were unreachable without a VPN.
The 2026 blackout
In June 2026, during the latest cycle of unrest, Iran imposed the most severe blackout in its history. NetBlocks measured national connectivity falling below 5% of normal for nearly nine consecutive days. Mobile data was cut province by province; international bandwidth was reduced to a trickle that effectively allowed only state-approved domestic services to function.
Hospitals could not reach reference databases. Importers could not clear shipments. Families abroad lost contact with relatives for days. The economic cost, estimated by the Tehran Chamber of Commerce alone, exceeded 1.5 billion dollars. The regime accepted the price. The point of the blackout was not to save money — it was to make protests invisible.
The National Information Network
The long-term project the regime calls SHOMA — the National Information Network — is the answer to its own blackouts. It is a domestic internet, hosted on servers inside Iran, that can keep working when the international link is severed. Banking, taxi apps, food delivery, state media and government services all run on this domestic layer. Foreign sites do not.
SHOMA lets the state pull a switch: cut the international gateway, and ordinary Iranians can still pay for groceries and call a taxi, but they cannot reach Twitter, BBC Persian, or each other across the diaspora. The infrastructure of daily life is preserved. The infrastructure of dissent is severed. This is the Filternet's quiet endgame.
The engineers fighting back
Against this stands a quieter resistance. Tor's Snowflake project, Lantern, Psiphon and dozens of smaller circumvention tools are maintained largely by Iranian engineers in exile. The Open Technology Fund estimates that more than 70 million VPN installs have been recorded inside Iran since 2022 — in a country of 88 million.
Inside Iran, sysadmins quietly route traffic through residential proxies. Journalists pass encrypted satellite phones across borders. Teenagers teach their grandparents how to install Outline. Every blackout has been answered, within hours, by a wave of new bridges, new domains, new ways to slip past the wall. The state controls the cables. It does not control the will to use them.
What 'cyber sovereignty' really means
Tehran frames Filternet as cyber sovereignty — the right of a nation to police its own information space, modeled openly on China's Great Firewall and Russia's RuNet. In practice, sovereignty is not what the system delivers. It delivers surveillance, throttling, economic damage, and an information environment where the regime's narrative is the loudest because it is often the only one that loads.
The blackouts of 2019, 2022 and 2026 each ended the same way: with the internet eventually returning, and with the protesters' footage, names and faces flooding the world hours later. The lesson the regime keeps refusing to learn is that the wall does not silence the country. It only delays the moment when the country speaks.
Documenting the post-June 2026 technical landscape
Since the publication on 2026-06-23, documented evidence from NetBlocks and IHRNGO suggests a shift in Tehran's strategy. Rather than risk the $1.5 billion economic shock of total blackouts noticed in June, authorities are deploying more sophisticated 'white-listing' techniques. This involves allowing unrestricted access to domestic IP ranges while implementing deep packet inspection (DPI) to identify and throttle VPN handshakes. Human rights monitors report that this 'soft' filtering is harder to track but equally effective at preventing the transmission of high-resolution video evidence of rights violations.
The documentation record remains contested regarding the scale of indigenous hardware integration. While state media claims total sovereignty via locally manufactured routers, the Abdorrahman Boroumand Center notes that the core architecture still relies on modified international equipment. Since August 2026, there has been an observed increase in the arrests of local 'tech-savvies'—informal network engineers providing VPN support—indicating that the state is targeting the human infrastructure of the resistance as much as the digital protocols themselves.
- July 2026: The ICT Ministry mandated all domestic banking apps migrate exclusively to the SHOMA network (IranWire).
- August 12, 2026: HRANA documented the detention of three network administrators in Shiraz for distributing Snowflake bridges.
- September 2026: NetBlocks reported a 40% increase in 'connection resets' for TLS 1.3 traffic across Iranian ISPs.
- October 2026: IHRNGO identified new state-sponsored 'clone' apps designed to harvest data from users seeking Telegram alternatives.
- October 5, 2026: The UN OHCHR raised concerns regarding the 'User Protection Bill's' latest enforcement phase.
Frequently Asked Questions
How does the 'Domestic Cloud' initiative impact international accountability?
The move to domestic hosting allows the state to isolate data from international legal reach. By forcing companies to host user data on servers physically located in Iran, the judiciary gains direct access to metadata and private communications without requiring international warrants. This facilitates the rapid identification of protesters based on their digital footprint before they can export evidence to human rights organizations (Abdorrahman Boroumand Center, 2026).
What is 'Layered Throttling' and why is it used instead of a total shutdown?
Layered throttling is the intentional slowing of specific protocols (like UDP or HTTPS) while keeping the National Information Network fast. This minimizes the broad economic damage of a total blackout—which cost Iran $1.5 billion in June 2026—while specifically breaking the functionality of VPNs and encrypted messaging apps. It allows the state to maintain commerce while selectively blinding the population (NetBlocks, 2026).
Are satellite-based internet solutions currently bypassing the Filternet?
While satellite terminals provide a theoretical bypass, their use remains limited by high costs and the physical risk of importation. Security forces have increased the use of signal-jamming equipment in urban centers like Tehran and Mashhad to disrupt unauthorized satellite signals. Furthermore, the state monitors the entry of hardware, making large-scale adoption a high-risk endeavor for the average citizen (IranWire, 2026).
