Restoring Digital Connectivity for the Iranian People: A Technical White Paper on Censorship Architecture and Feasible Circumvention Strategies

ABSTRACT

The Islamic Republic of Iran has constructed one of the most technically sophisticated internet censorship and shutdown regimes in the world. Through a layered architecture combining deep packet inspection (DPI), DNS poisoning, protocol whitelisting, Border Gateway Protocol (BGP) manipulation, and a state-controlled national intranet, the Iranian government has demonstrated an accelerating capacity to sever its population of approximately 92 million from the global internet. The 2026 internet blackout — the longest and most comprehensive in the country’s history — has focused international attention on both the mechanisms of digital repression and the feasibility of technical countermeasures. This white paper provides a systematic technical examination of Iran’s censorship infrastructure, drawing on network measurement research, governmental and civil society reports, and primary-source legal and regulatory texts in Persian and English, before advancing a multi-layer framework of technical and policy interventions capable of restoring meaningful internet access to the Iranian people.

1. INTRODUCTION

On 8 January 2026, Iranian authorities imposed a near-total internet and communications blackout coinciding with nationwide anti-government protests that had begun on 30 December 2025. Since that date, the Iranian government has imposed an internet blackout that has severely curtailed telephone and internet communications across Tehran, Isfahan, Lordegan, Abdanan, parts of Shiraz, and Kermanshah — with Cybersecurity experts reporting that even Iran’s National Information Network had been fully disconnected. Unlike previous Iranian internet shutdowns, in which the domestic intranet — the National Information Network (NIN) — remained functional to keep banking and administrative sectors running, the 2026 blackout disrupted local infrastructure as well, disabling mobile networks, text messaging services, and landlines.

This event did not arise in a vacuum. It represents the culmination of more than two decades of deliberate infrastructure construction. Internet censorship in Iran functions similarly to the Great Firewall of China, and stricter monitoring through the National Information Network (NIN) was employed as far back as the 2019 Iranian protests, making it more difficult for videos of unrest to be posted or viewed on social media. The economic toll has been severe. The Iranian Minister of Communications, Sattar Hashemi, acknowledged that the shutdown was costing the economy $35.7 million per day, while online sales fell 80%, the Tehran Stock Exchange lost 450,000 points over four days, and financial transactions dropped by 185 million in January 2026.

The international community has increasingly characterized internet access not merely as a commercial convenience but as a prerequisite for the exercise of fundamental human rights. In their 2015 Joint Declaration on Freedom of Expression and Responses to Conflict Situations, United Nations experts stated that even in times of conflict, the use of communication “kill switches” — i.e., shutting down entire parts of communications systems — can never be justified under human rights law.

This white paper proceeds as follows: Section 2 maps the legal and institutional framework of Iranian internet governance. Section 3 provides a technical analysis of the censorship mechanisms employed. Section 4 examines historical shutdown events. Section 5 surveys existing circumvention tools and their limitations. Section 6 proposes a multi-layer framework of technical solutions. Section 7 addresses policy considerations, and Section 8 concludes.

2. LEGAL AND INSTITUTIONAL FRAMEWORK OF INTERNET GOVERNANCE IN IRAN

2.1 The Supreme Council of Cyberspace

Iran’s internet governance is not a monolithic bureaucratic function but a multi-institutional apparatus whose apex authority is the Supreme Council of Cyberspace (SCC; شورای عالی فضای مجازی). Established in 2012, the SCC sits above all ministerial authorities and reports directly to the Supreme Leader. The SCC’s mandate encompasses setting censorship policy, regulating content, and determining the architecture of the National Information Network.

In February 2024, the Supreme Council for Cyberspace (SCC) prohibited the use of unlicensed virtual private networks (VPNs) and pushed users seeking to access blocked or filtered web content to use domestic circumvention tools. By July 2025, the SCC had passed a regulation formally institutionalizing a two-tiered internet hierarchy — known as Internet-e-Tabaqati — under which access to the global internet is no longer a default for citizens but instead a privilege granted based on loyalty and professional necessity.

2.2 The Telecommunication Infrastructure Company (TIC) and ISP Monopoly

The Telecommunication Infrastructure Company (TIC) retains a monopoly on internet traffic flowing in and out of the country. In October 2021, local news agencies reported a shortage in international bandwidth due to the SCC’s refusal to grant new licenses to ISPs for international connections via the TIC, while previous licenses expired with no renewals.

The IRGC’s role in this architecture is pervasive. According to Alex Moses, a researcher at Holistic Resilience, the Islamic Revolutionary Guard Corps (IRGC) holds significant ownership or shareholder stakes in nearly all telecommunication systems in Iran, granting them full control over information processing and data collection and enabling what Moses characterizes as “an unprecedented level” of mass surveillance.

2.3 The Internet User Protection Bill (IUPB)

Iran’s Internet User Protection Bill (IUPB) — which has been partially implemented despite not having received parliamentary approval — will further centralize Iran’s internet backbone under the government. Article 3 of the bill gives the Supreme Regulatory Commission (SRC), a body within the SCC, the power to set bandwidth limits and manage access to both the international and domestic internet.

2.4 The “White SIM Card” System: A Digital Caste Hierarchy

The implementation of the tiered internet includes “white SIM cards”: special mobile lines issued to government officials, security forces, and approved journalists that bypass the state’s filtering apparatus entirely. While ordinary Iranians are forced to navigate a maze of unstable VPNs and blocked ports, holders of white SIMs enjoy unrestricted access to Instagram, Telegram, and WhatsApp. This system has been described in Iranian civil society discourse as apartheid-e dizhital (آپارتاید دیجیتال), or “digital apartheid.” In November 2025, X’s “About This Account” feature exposed accounts in Iran that were accessing the platform without VPNs, revealing that hardline lawmakers who publicly supported internet restrictions were personally enjoying unrestricted access through white SIM cards.

2.5 Iranian Legal Justifications and Persian-Language Regulatory Texts

Iranian state officials have deployed a range of justifications for the NIN. According to officials, the main stated reason for establishing the NIN is to create a “safe” and “pure” network (Internet-e Paak, or اینترنت پاک) for Iranian internet users that is “free from immoral, corrupt, and violent content on the Internet,” and the NIN is intended as a medium through which the government propagates the revolutionary Islamic discourse to young people. Iran’s Prosecutor General, Mohammad Jafar Montazeri, has publicly referred to the internet as a “slaughterhouse” and a bastion of “blasphemy, anti-national security teachings, and destruction of the identity of the youth” (cited in Middle East Institute analysis of Iranian regulatory history). The Islamic narrative that has formed the basis of Iranian national identity since 1979 is intensely preserved through censorship and state propaganda, and officials argue the NIN is necessary to maintain this identity.

3. TECHNICAL ARCHITECTURE OF IRAN’S CENSORSHIP INFRASTRUCTURE

3.1 Centralized Chokepoints and the “Great Firewall of Iran” (GFI)

Research by Aryan et al. (2013) at USENIX represents a foundational contribution to understanding Iran’s censorship infrastructure. The Iranian government operates one of the largest and most sophisticated internet censorship regimes in the world, and network mapping has found evidence that it relies heavily on centralized equipment — a property that might be fruitfully exploited by next-generation approaches to censorship circumvention.

At the top of the network hierarchy sits the Core Network, where all networks converge, managed by the Telecommunication Infrastructure Company (TIC). Within the core layer, the Central Cloud handles data exchange at the national scale, and high-level traffic control, blocking, and censorship policies are enforced. It passes through Secure Border Gateways, which function as chokepoints for control and filtering, connecting the NIN to the international gateway through which external connectivity is established.

Recent technical research by Aryapour (2025) confirms this centralization: the censoring packets consistently originated just beyond the Iranian gateways, indicating a single common chokepoint. Correlating with routing data, this chokepoint appears to be at the national border, at AS gateways operated by TCI. Filtering was not happening separately at each ISP but at a unified “filternet” node, which ensures uniform policy across the country and makes it easier for authorities to reconfigure or intensify a blackout rapidly.

3.2 Layer-by-Layer Censorship Mechanisms

Iran’s censorship system employs multiple overlapping technical mechanisms, which Bock et al. (2020) have termed “censorship-in-depth”:

3.2.1 DNS Poisoning and Hijacking

DNS-based censorship forms the foundational layer of Iran’s filtering architecture. IRBlock research confirms that DNS censorship demonstrated remarkable stability throughout the measurement period from late 2024 into January 2025, consistently affecting over 6.5 million IPs daily, and that the stability of DNS blocking highlights its role as a foundational layer of the GFI’s censorship infrastructure. DNS poisoning intercepts queries for forbidden domains and returns falsified responses, effectively redirecting users to government block pages.

3.2.2 HTTP Host-Based Blocking and Keyword Filtering

A centralized system intercepts web traffic and redirects forbidden requests to a government-owned block page at the private IP address 10.10.34.34. The filters inspect HTTP hostnames and URL keywords and inject censorship pages or TCP resets for banned content.

3.2.3 Deep Packet Inspection (DPI)

DPI is the most powerful and invasive tool in Iran’s censorship arsenal. The Iranian government’s approach has combined DNS poisoning to redirect or block requests for foreign websites, protocol whitelisting to allow only pre-approved domestic services, and Deep Packet Inspection (DPI) to aggressively filter and block traffic from specific tools — a combination that neutralized many circumvention tools without fully halting domestic services.

Research by Lange et al. (2025) further refined understanding of the DPI deployment: Iranian censorship systems inspect the TLS handshake, particularly the Server Name Indication (SNI) field, to block services like Telegram or Instagram. A national protocol filter has been identified that only allows DNS, HTTP, and HTTPS — meaning any other protocol, including SSH and VPNs, is immediately blocked by DPI.

3.2.4 Protocol Whitelisting

During the 2025 stealth blackout, only DNS (port 53), HTTP (port 80), and HTTPS (port 443) traffic from Iranian networks to external servers generally went through. All other protocols tested — including OpenVPN (UDP/1194) and generic TCP/UDP on various ports — were dropped without response, representing a strict whitelist.

3.2.5 UDP Traffic Blocking and QUIC Interference

UDP-based blocking affected approximately 5 million IP addresses, exclusively a subset of those already censored via DNS, with the blocking correlated with a sharp rise in the proportion of HTTP/3 traffic — the QUIC protocol — indicating that as the Iranian government recognized QUIC adoption, it moved to suppress it as well.

3.2.6 BGP-Based Shutdown vs. “Stealth” Shutdown

The evolution of Iran’s shutdown methodology reflects a strategic learning curve. In 2019, the Iranian government cut the country off from the global internet by simply taking down Border Gateway Protocol (BGP) routes. In contrast, the June 2025 shutdown did not involve severing BGP routes, which allowed the country to retain an outward appearance of normal connectivity for traditional monitoring tools. This represents what researchers term an “imperceptible shutdown”: Iran remained globally reachable while effectively severing real connectivity, and by keeping BGP announcements alive, the government avoided immediate alarm in global routing monitors.

3.3 The National Information Network (NIN): Architecture and Function

The National Information Network (NIN; شبکۀ ملی اطلاعات, Shabake-ye Melli-ye Ettelā’āt), is an ongoing project backed by the IRGC to develop a secure, stable, centrally controlled, digitally surveilled infrastructure network and national intranet in Iran. The Supreme Council of Cyberspace defines the NIN as “a network based on the Internet Protocol with switches and routers and data centers which allows for data requests to avoid being routed outside of the country and provides secure and private intranet networks.”

The Edge Cloud layer of the NIN consists of data centers, CDNs, and related infrastructure that allow traffic between users on different networks across the country to be exchanged at high speed without passing through the core network and without requiring centralized connectivity — a design intended to reduce dependence on international routes for the circulation of domestic data.

A critical design objective of the NIN is operational independence from the global internet during political crises. The establishment of the NIN as an independent network provides officials with the option of cutting off access without affecting the country’s administration. During the 2009 shutdown, for example, the Iranian government interrupted its own banking and government operations by cutting the internet; with the NIN, a similar outage would not interrupt internal network traffic.

Chinese experts are believed to have helped build the NIN’s infrastructure and surveillance algorithms, and China, adept at both skirting U.S. sanctions and creating digital firewalls, has served as a key ally in Iran’s digital isolation project.

3.4 Surveillance Integration

During the Women, Life, Freedom movement, it was revealed that mobile phone regulators have direct access to systems allowing them to track users’ locations in real time, monitor metadata, and interfere with mobile connectivity. Because SIM cards and devices are tightly linked to national identity information and unique device identifiers, switching SIM cards or phones offers little protection. Authorities can map social networks, identify protest organizers, and trace individuals’ movements before, during, and after demonstrations — turning ordinary telecommunications infrastructure into a powerful surveillance weapon.

4. HISTORICAL SURVEY OF MAJOR INTERNET SHUTDOWNS IN IRAN

4.1 The 2019 “Bloody November” Blackout

During the November 2019 fuel protests, Iran imposed its first near-total internet blackout using BGP route withdrawal. On November 17, 2019, in response to fuel protests, the country shut down nearly all internet access, reducing internet traffic to approximately 5% of ordinary levels. The shutdown lasted approximately seven days and coincided with the killing of an estimated 1,500 protesters.

4.2 The 2022 Woman, Life, Freedom Protests

During the nationwide Woman, Life, Freedom protests of September 2022, Instagram and WhatsApp — the only two major international platforms that had remained accessible in Iran — were blocked. The Google Play Store and Apple’s App Store were filtered, and localized internet shutdowns were deployed across protest zones.

4.3 The June 2025 “Stealth Blackout” During the Israel-Iran War

The June 2025 internet shutdown, carried out during the war with Israel, marked a significant and strategically distinct moment in digital repression. This operation, termed the “stealth blackout,” differed sharply from earlier shutdowns. Iran’s traffic and connectivity to the global internet plummeted by approximately 90%, but BGP routes were maintained to preserve the outward appearance of normal operation.

Psiphon’s multi-protocol design was crucial in maintaining access for 1.5 million users at the height of the June 2025 shutdown. Lantern saw moderate success with its proxyless protocol, which accounted for approximately 40% of its traffic. The Ceno Browser, with its decentralized peer-to-peer network, saw a significant increase in active peers, from 600 on June 13 to nearly 8,000 by July 11.

4.4 The 2026 Blackout: The Most Severe in Iranian History

Measurements by the Internet Outage Detection and Analysis (IODA) project at Georgia Institute of Technology showed a nominal connectivity figure of approximately 3% from January 8, 2026 — potentially an artifact of measurement or lingering connectivity for whitelisted government services — representing the most complete shutdown in Iran’s history, surpassing the 2019 event in both duration and scope.

When a few domestic services became available during the 2026 blackout, the state surgically removed social features such as comment sections on news sites and chat boxes in online marketplaces — a level of granular social control that distinguishes the 2026 event from all prior shutdowns.

5. EXISTING CIRCUMVENTION TOOLS: CAPABILITIES AND LIMITATIONS

5.1 Commercial and Standard VPNs

Standard VPN protocols — OpenVPN, WireGuard, IPsec — have been effectively neutered by Iran’s DPI and protocol whitelisting systems. For citizens, the layered censorship posed severe challenges to circumvention. DNS-based blocking prevented VPN software from resolving servers, HTTP-level filters could detect and drop known VPN signatures on port 443, and the protocol whitelist outright eliminated many tunneling methods.

Not all obfuscation is equal. Early techniques added padding or modified packet headers in ways that are now detectable. Modern approaches aim for full protocol-level mimicry: the VPN connection should be statistically indistinguishable from a normal HTTPS session. The core idea is traffic masquerade using TLS 1.3, with no obvious VPN handshake patterns or packet signatures for DPI to flag.

5.2 Psiphon

Psiphon has emerged as the most effective and widely deployed circumvention tool for Iran. As Keith McManamen from Psiphon explains, the software is built on a multi-protocol architecture that performs real-time diagnosis of network conditions. “We use transports designed to stay below the radar — protocols that look like random noise or common web traffic. We are also constantly innovating parameters like packet size and interval based on what we see in the network.”

On January 22, 2026, over half of the 2.8 million global connection attempts to Psiphon originated from Iran, with peaks of over 40,000 simultaneous users. Psiphon Conduit, an application allowing users outside Iran to securely share their bandwidth with users inside the country, became a key tool of the diaspora response.

5.3 Tor and Snowflake

Tor’s Snowflake bridge represents one of the most technically sophisticated obfuscation tools available. The Tor Project expects Snowflake to continue functioning under Iran’s whitelisting system, provided that blocking efforts remain primarily focused on data centers, owing to Snowflake’s use of WebRTC — a protocol associated with legitimate web browsing — as its transport layer.

5.4 Lantern and Ceno Browser

Lantern’s proxyless protocol, which disguises traffic patterns, has shown resilience in Iran. The Ceno Browser, developed by eQualitie, employs a decentralized, peer-to-peer network model. Even during the 2025 blackout, some Ceno connections remained online owing to the browser’s mesh-like routing architecture, which distributes traffic across many peers rather than through centralized servers.

5.5 Starlink and Satellite Internet

Starlink has been characterized as a “game changer” in connectivity because it provides access that does not depend on state sovereignty over terrestrial infrastructure. SpaceX made Starlink free in Iran during the 2026 blackout, and it is estimated that approximately 50,000 terminals have been smuggled into the country.

However, the Iranian government has mounted significant countermeasures. The regime countered Starlink with a large-scale GPS jamming campaign, causing up to 80% packet loss for Starlink connections, and reportedly disabled 40,000 terminals. Security forces also conducted door-to-door raids to confiscate satellite dishes. The Trump administration reportedly smuggled six thousand additional Starlink terminals into Iran in response.

Digital rights experts warn that operating Starlink without a VPN-like tool makes users easier for authorities to geolocate. In contrast, US-funded circumvention tools offer a more anonymous, scalable, and cost-effective lifeline for the broader population.

5.6 Toosheh: Filecasting Over Satellite TV

Created by US-based nonprofit NetFreedom Pioneers, Toosheh is a “filecasting” technology using home satellite TV equipment to broadcast encrypted data to people in Iran. Users record from the Toosheh satellite TV channel onto a USB stick plugged into their set-top box, which they can then decrypt using a special app installed on their phone or computer. From that initial download, the data can be copied and shared across multiple households, with an estimated three million active users in Iran across 2025.

5.7 Shortwave Radio Broadcasts

Amsterdam-based nonprofit Radio Zamaneh began shortwave broadcasts during the January 2026 protests, sending a nightly Farsi news program. As Radio Zamaneh’s executive director Rieneke van Santen explained, “It’s really difficult for the regime to jam shortwave because it’s a long-distance broadcast.”

6. A MULTI-LAYER TECHNICAL FRAMEWORK FOR RESTORING INTERNET ACCESS

The following framework is proposed as a technically feasible, layered response to Iran’s censorship architecture. Because Iran employs “censorship-in-depth,” effective restoration of access requires equally multi-layered solutions.

6.1 Layer 1 — Direct-to-Cell (D2C) Satellite Technology

The most transformational and technically promising solution is direct-to-cell (D2C) satellite connectivity. Unlike conventional satellite internet requiring conspicuous ground dishes like Starlink terminals, D2C connects directly to standard smartphones without any specialized hardware — using mobile frequency bands transmitted from low-earth-orbit (LEO) satellites.

A coalition of civil society organizations has already launched a campaign calling for “direct-to-cell” satellite connectivity. Unlike traditional satellite internet, which requires conspicuous and expensive dishes, D2C technology connects directly to standard smartphones and is much more resilient to infrastructure shutdowns. General licenses should be expanded to cover satellite connectivity explicitly, and funding should be directed toward technologies that are harder to whitelist or block, such as mesh networks and D2C solutions that bypass the chokepoints of state-controlled ISPs.

Providers currently deploying D2C technology include SpaceX (Starlink Direct to Cell), AST SpaceMobile, and Amazon Project Kuiper. For Iran specifically, D2C presents several critical advantages: it requires no imported hardware that customs officials can confiscate; it is accessible to any ordinary smartphone user; and it is far more difficult for ground-based GPS jamming to neutralize at scale, since the frequency bands are different from standard Starlink terminal bands. The technical challenge involves roaming agreements, but a humanitarian-access protocol, mandated by regulatory bodies, could bypass ordinary carrier agreements.

U.S. legislators have introduced the FREEDOM Act, which would require the Secretary of State, the FCC, and the Treasury to assess technologies capable of supporting unfiltered internet access for Iranians, with Representative Claudia Tenney highlighting the potential of satellite-to-mobile systems that could “bypass the limitations of censorship and government networks.” The feasibility review would also evaluate UAV-based platforms and counter-jamming tools.

Technical Implementation Pathway:

SpaceX’s Starlink D2C constellation, currently operational with a subset of satellites, could be authorized for humanitarian access over Iran. FCC regulations governing international satellite broadband would need to be adjusted via general license to permit this.
T-Mobile and other carrier partners of Starlink D2C would need to extend roaming agreements for Iran under a humanitarian exemption.
The network should employ end-to-end encryption at the application layer to protect user identity from IRGC signal intelligence.

6.2 Layer 2 — Next-Generation Obfuscated Tunneling

For connectivity that does exist at some level (as was the case in the 2025 “stealth blackout”), obfuscated tunneling remains the most scalable solution for the widest population.

Effective evasion of Iran’s multi-layer censorship now requires multi-layer obfuscation — for example, wrapping VPN traffic in seemingly innocuous HTTPS to defeat the protocol whitelist, while simultaneously defeating SNI-based filtering through techniques such as ESNI (Encrypted Server Name Indication) or ECH (Encrypted Client Hello), which prevents DPI from reading the SNI field.

Key technical approaches include:

Domain Fronting: Routing obfuscated VPN connections through major CDN providers (Cloudflare, Fastly, Amazon CloudFront) makes the traffic appear to originate from and be destined for major legitimate platforms. Since Iran cannot block Cloudflare without breaking large swaths of the legitimate internet, domain fronting creates a structural dilemma for censors.

QUIC-Based Tunneling: Given that QUIC runs over UDP and is increasingly deployed for legitimate HTTPS traffic (HTTP/3), obfuscated QUIC tunnels may be able to hide within the growing volume of legitimate QUIC traffic. While Iran has begun blocking QUIC, the protocol’s widespread adoption creates ongoing pressure against blanket blocking.

Meek and Obfs4 Transports (Tor): These Tor pluggable transports disguise Tor traffic as generic HTTPS or as traffic mimicking specific services. They should be further optimized with adaptive packet sizing and inter-packet timing randomization to defeat statistical fingerprinting employed by advanced DPI systems.

Psiphon’s Multi-Protocol Approach: Psiphon’s documentation reveals its use of SSH-based tunneling with added obfuscation to reduce protocol fingerprinting, as well as support for VPN modes. The software is explicitly engineered for constrained environments and is widely known in Iran, explaining why it becomes a default search term when connectivity is constrained.

6.3 Layer 3 — Decentralized Peer-to-Peer and Mesh Networking

Mesh networks represent a structurally different approach that does not rely on any single circumvention server or external connection point and is therefore resistant to centralized blocking.

Delay-Tolerant Networking (DTN): Adapted from military and disaster-relief contexts, DTN protocols can route data across intermittently connected nodes, using the “store-carry-forward” paradigm. A device that briefly connects to Starlink or a border WiFi source can store data and relay it to other devices via Bluetooth, WiFi-Direct, or even physical media — creating a “sneakernet” immune to DPI.

Meshtastic / LoRa Mesh Networks: LoRa (Long Range) radio technology operates in unlicensed spectrum (433 MHz and 915 MHz bands) and can propagate encrypted text messages over distances of several kilometers between devices. Meshtastic-enabled devices have been used in protest contexts internationally and require no internet infrastructure. Cross-border LoRa relay chains could provide text-based communications and small file transfers across sections of Iran.

The Ceno Browser’s P2P Model: The Ceno Browser’s decentralized peer-to-peer network demonstrated its resilience during the 2025 blackout, with the number of active peers growing from 600 on June 13 to nearly 8,000 by July 11. The model’s strength is that even during a near-total blackout, some Ceno connections remained online. Scaling this model through mass distribution of the Ceno application — preloaded on devices smuggled into Iran or downloaded when brief connectivity windows open — would dramatically increase network resilience.

6.4 Layer 4 — High-Altitude Platform Stations (HAPS) and UAV-Based Relay

High-Altitude Platform Stations — aircraft or balloons stationed in the stratosphere at approximately 20 kilometers altitude — could provide broadband internet coverage to areas below without relying on ground infrastructure within Iran. HAPS systems have been developed by Airbus (Zephyr), SoftBank/HAPSMobile (Sunglider), and various defense contractors. At 20 km altitude, a single HAPS platform can cover a footprint of approximately 200-500 km diameter.

The proposed FREEDOM Act’s feasibility review explicitly includes evaluation of UAV-based platforms and counter-jamming tools for Iran connectivity restoration.

Technical considerations:

HAPS communicate with ground devices using LTE/5G protocols, meaning any smartphone could connect without specialized hardware.
Operating HAPS platforms would need to be located in international airspace above 20 km (exceeding normal sovereign airspace claims under the Chicago Convention of 1944, which defines sovereignty up to the stratosphere-mesosphere boundary).
Frequency coordination under ITU Radio Regulations would be required; however, emergency humanitarian provisions exist within the ITU framework.
Iran’s military has demonstrated the ability to target drones; HAPS platforms at 20 km would be at the upper limit of conventional surface-to-air missile engagement, though not immune.

6.5 Layer 5 — Sanctions Reform and Technology Export Policy

A critical and often overlooked technical barrier is that U.S. economic sanctions have inadvertently weakened the circumvention ecosystem. Sanctions enacted in 2010 prevented U.S. companies from hosting “.ir” domains, and because U.S. companies make up a disproportionate amount of critical internet infrastructure, many of the critical VPN services needed by Iranians are hosted on American platforms and are inaccessible to activists and journalists.

The updated IRAN Act directs the relevant agencies to work with Treasury and Commerce to ensure that enforcement of sanctions does not prevent companies from providing the technology and other tools necessary to access the open internet, including VPNs, satellite internet, and direct-to-cell satellite technologies.

Specific technical products that require general license modifications include:

Starlink terminal hardware and subscription services
VPN applications distributed via app stores
SSL certificate authorities for .ir domains
Cloud hosting services for circumvention tool infrastructure
Cryptographic hardware for endpoint security

6.6 Layer 6 — Counter-Jamming and Electronic Warfare Support

Iran’s GPS jamming campaign against Starlink terminals represents a military-grade countermeasure. The technical response involves:

Frequency Hopping: Modern satellite terminals can be configured to employ frequency-hopping spread spectrum (FHSS), which spreads the signal across multiple frequencies in rapid succession, making sustained jamming far more difficult and requiring the jammer to track frequency changes faster than is practically achievable.

Beam Steering and Spot-Beam Technology: Next-generation LEO satellites employ electronically steered phased-array antennas capable of concentrating signal power into narrow spot-beams, dramatically increasing link margin against interference. Deploying this capability specifically over Iran during blackout periods would require SpaceX to reconfigure its satellite constellation software — technically feasible without hardware changes.

Cross-Links and Network Diversity: Ensuring that Iranian-aimed terminal traffic routes through multiple satellite hops and ground stations in different countries reduces the efficacy of any single jamming installation.

6.7 Layer 7 — Diaspora-Powered Bandwidth Sharing

As of February 2026, there were approximately 400,000 Iranians abroad who had used Psiphon Conduit to allow people inside Iran to access the internet. This diaspora-powered model can be substantially scaled:

Technical scaling approach: Building a standardized, user-friendly application for the diaspora community that automatically allocates a portion of users’ residential broadband connections as Psiphon-style relay nodes would dramatically expand available bandwidth. Automated geographic routing would direct Iranian users to nearby diaspora nodes, reducing latency. Rate limiting and traffic shaping would ensure minimal impact on diaspora users’ own connections. This model is scalable to millions of nodes without centralized infrastructure.

Security considerations: All relay traffic must be encrypted end-to-end; relay operators must not be able to inspect content. Zero-knowledge proofs or onion routing should be employed to protect both the relay operator and the Iranian user from traffic analysis.

7. POLICY RECOMMENDATIONS

7.1 International Regulatory Action

The ITU’s Radio Regulations Committee (RRC) has regulatory authority over the frequency spectrum used by satellite communications. Iran sued Starlink in the ITU based on Article 18 of the Radio Regulations and WRC Article 23, compelling Starlink to cut access in Iran. A coordinated diplomatic response should challenge the use of ITU procedures as instruments of political censorship and advocate for explicit humanitarian internet access provisions within the ITU framework.

7.2 Legislation

The Iran Human Rights, Internet Freedom, and Accountability Act of 2026, introduced by Senators McCormick and Rosen, designates the Secretary of State as lead official for advancing internet access and digital freedom in Iran, increases funding for the Iran Internet Freedom Grant Program to at least $20 million annually from fiscal years 2027 to 2030, and establishes a State Department-led interagency working group to develop rapidly deployable technologies capable of bypassing internet shutdowns.

7.3 Technology Company Obligations

A group of Iranian digital rights and internet freedom activists has written an open letter to the International Telecommunication Union and the international internet community, reminding the international community that it is misleading and dangerous to promote a concept of national digital sovereignty at the expense of a free global internet. Technology companies must be required through their licensing agreements and terms of service to include humanitarian access protocols that can be activated during designated crisis periods — ensuring that connectivity is treated as a humanitarian imperative rather than a commercial product subject to governmental override.

7.4 Coordination Among Freedom Tech Organizations

The 2025 blackout demonstrated the value of coordination. The overall success of circumvention efforts in June 2025 demonstrated that utilizing different technologies, methodologies, and networks increases the possibility of sustained connection even during the most severe internet shutdowns, and the internet freedom community succeeded in keeping millions of Iranians online by sharing information and deploying a greater variety of tools than had been available during 2019.

A standing interoperability framework among Psiphon, Tor Project, Lantern, eQualitie (Ceno), and other freedom tech organizations would reduce coordination time from days to hours during future blackout events.

8. CONCLUSION

Iran’s internet censorship and shutdown infrastructure represents the most technically sophisticated and organizationally entrenched digital repression system outside of China. Its architecture — combining centralized chokepoints, deep packet inspection, protocol whitelisting, DNS poisoning, a state-controlled national intranet, and a tiered access system privileging regime loyalists — is deliberately designed to deny ordinary citizens the rights to expression, assembly, and information during precisely those moments when the need for those rights is greatest.

The internet is viewed, in the words of cybersecurity expert Amir Rashidi, as “an enemy” by the Iranian government, which seeks to “control and suppress it.” The human cost of this posture has been catastrophic. During the 2026 blackout, the Human Rights Activists News Agency (HRANA) verified over 5,700 deaths and was seeking to verify more than 17,000 additional possible deaths.

Yet the technical record also demonstrates resilience. Iranian civil society, the diaspora, and the international freedom-tech community have repeatedly found ways to maintain partial connectivity under even the most severe conditions. The path forward requires not merely incremental improvement of existing tools but a structural reorientation — treating internet access in Iran as a humanitarian emergency requiring the deployment of space-based, decentralized, and hardware-independent connectivity solutions that are beyond the reach of ground-based censorship infrastructure.

The Iranian people’s right to communicate, to know, and to speak is not a technical preference to be balanced against state sovereignty claims. As the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression affirmed in 2016 (A/HRC/32/38), deliberate internet shutdowns violate international human rights law. The technical means to partially restore that right exist. The remaining barriers are principally political and financial — and those barriers are far more tractable than the engineering ones.

REFERENCES

Primary and Government Sources:

Supreme Council of Cyberspace (شورای عالی فضای مجازی), Islamic Republic of Iran. Charter and Regulatory Mandates of the SCC, 2012–2025. (Persian-language regulatory documentation referenced in secondary analyses below.)
Telecommunication Infrastructure Company of Iran (شرکت زیرساخت ارتباطات ایران), Ministry of ICT. NIN Architecture Documents, 2013–2024. Cited in Raaznet.com analysis, “Inside Iran’s National Information Network.”
Iran Internet User Protection Bill (IUPB; طرح صیانت از فضای مجازی). Draft legislation partially implemented 2022–2024. Article 3 cited in Freedom House, Freedom on the Net 2024 — Iran.
United Nations Human Rights Council. Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, A/HRC/32/38. Geneva, 2016.
United Nations experts, 2015 Joint Declaration on Freedom of Expression and Responses to Conflict Situations. Referenced in Human Rights Watch, “Iran: Internet Shutdown Violates Rights, Escalates Risks to Civilians,” March 2026.
U.S. Senate. Iran Human Rights, Internet Freedom, and Accountability Act of 2026. Senators Dave McCormick (R-PA) and Jacky Rosen (D-NV), introduced February 24, 2026.
U.S. House of Representatives. Internet Reach and Access NOW (IRAN) Act. Rep. Eric Swalwell et al., introduced February 2026.
U.S. House of Representatives. FREEDOM Act. Rep. Claudia Tenney et al., introduced December 2025.

Academic and Technical Research:

Aryan, S., Aryan, H., & Halderman, J. A. (2013). “Internet Censorship in Iran: A First Look.” Proceedings of the USENIX Workshop on Free and Open Communications on the Internet (FOCI). Washington, D.C.: USENIX.
Bock, K., et al. (2020). “Even Censors Have a Backup: Examining China’s Double-Layer Firewall.” Proceedings of the ACM Internet Measurement Conference. (Framework of “censorship-in-depth” applied to Iranian context by subsequent researchers.)
Aryapour, A. (2025). “Iran’s Stealth Internet Blackout: A New Model of Censorship.” arXiv preprint arXiv:2507.14183. July 2025.
Lange, M., et al. (2025). “Measuring Iran’s Great Firewall: Case-Sensitive HTTP Matching and DNS Correlations.” Cited in Aryapour (2025).
Tai, K., et al. (2025). “IRBlock: Scanning Iran’s IP Space for Censorship.” Proceedings of the 34th USENIX Security Symposium. Seattle: USENIX.
Georgia Institute of Technology, Internet Intelligence Lab / Internet Outage Detection and Analysis (IODA) Project. “Iran’s Latest Internet Blackout Extends to Phones and Starlink.” The Conversation, January 16, 2026.

Civil Society and Policy Organizations:

Miaan Group, ASL19, and IODA. Report on Iran’s Blackout of the Global Internet. October 2026. Available: https://miaan.org/report-on-irans-blackout-of-the-global-internet/
Filterwatch / Chatham House. “Iran’s Stealth Blackout: A Multi-Stakeholder Analysis of the June 2025 Internet Shutdown.” October 5, 2025. Available: https://filter.watch/english/2025/10/02/irans-stealth-blackout-a-multi-stakeholder-analysis-of-the-june-2025-internet-shutdown/
Freedom House. Freedom on the Net 2024 — Iran Country Report. Washington, D.C.: Freedom House, 2024. Available: https://freedomhouse.org/country/iran/freedom-net/2024
Citizen Lab, University of Toronto. Deibert, R. & Rohozinski, R. (2012). “Iran’s National Information Network.” November 2012.
Raaznet. “Inside Iran’s National Information Network.” Available: https://raaznet.com/en/reports/inside-irans-national-information-network
Middle East Institute. “Shatter the Web: Internet Fragmentation in Iran.” November 20, 2025.
Article 19. “Tightening the Net 2020: After Blood and Shutdowns.” September 2020.
Schneier, B. “Iran’s Two-Tiered Internet Is Dangerous.” Foreign Policy, February 24, 2026.
Akbari, A. “Iran’s Case Should Put an End to Illusions About Digital Sovereignty.” Tech Policy Press, January 15, 2026. (Professor of Critical Data and Surveillance Studies, Goethe University Frankfurt.)

Legal and Human Rights Sources:

Human Rights Watch. “Iran: Internet Shutdown Violates Rights, Escalates Risks to Civilians.” March 6, 2026. Available: https://www.hrw.org/news/2026/03/06/iran-internet-shutdown-violates-rights-escalates-risks-to-civilians
Chicago Journal of International Law. “International Law and the Right to Global Internet Access: Exploring Internet Access as a Human Right Through the Lens of Iran’s Women-Life-Freedom Movement.” University of Chicago Law School, 2024.
Science (AAAS). Stone, R. “Iran’s Researchers Increasingly Isolated as Government Prepares to Wall Off Internet.” American Association for the Advancement of Science, 2023.

News and Monitoring Sources:

NetBlocks. Real-time network disruption monitoring data, Iran, January–March 2026. Available: https://netblocks.org
Cloudflare Radar. Iranian IPv6 blocking observations, May 2024; connectivity data, January 2026.
TechRadar. “Iranians Are Resilient; They Always Find Ways to Speak: How Iranians Are Overcoming Unprecedented Internet Censorship.” February 2026.
CNN. “The Future of Iran’s Internet Connectivity Is Still Bleak, Even as Weeks-Long Blackout Begins to Lift.” January 30, 2026.
Wikipedia (English). “2026 Internet Blackout in Iran.” Continuously updated, last accessed March 17, 2026. (Used for chronological event data cross-referenced against primary sources.)