Iran: how the Islamic Republic uses internet shutdowns as a tool of repression

When a protest by angry traders about what they see as the Islamic Republic’s poor handling of the economy morphed into a national uprising across Iran, the authorities moved quickly to shut down the internet. It’s a tactic the regime has used before. Closing down communications makes it harder for resistance to organise. It also makes it hard for people protesting in Iran to communicate with and enlist support from the outside world.

Authoritarian regimes, such as the Islamic Republic in Iran, tend to rely on two distinct modes for managing information and collective action. The first is surveillance. Communications are monitored, platforms filtered, metadata analysed, and users channelled toward spaces that remain visible to the state. In such conditions, limited circumvention is often tolerated.

The regime allows the use of virtual private networks (VPNs) for example, since only a fraction of the population is technically savvy enough to use them. A VPN is a tool that routes a user’s internet traffic through an external server, masking its destination and bypassing local restrictions. In practice, VPNs can help users evade censorship and reduce visibility to domestic internet controls by making their connections appear to originate from outside the country – though they still depend on the underlying internet infrastructure to function.

The second mode is shutdown, deployed under exceptional conditions. When people start to mobilise and their protests start to exceed the ability of the authorities to control them with surveillance and become visible to the outside world, the authorities escalate from monitoring communications to disrupting them.

Shutdowns are indiscriminate and economically damaging. But they sever the connective infrastructure that allows protest movements to form, share information, coordinate and scale up. Iran’s repeated shutdowns in 2019, 2022, and 2026 illustrate this transition from surveillance as a norm to shutdown as an emergency instrument of rule.

In Iran, shutdowns are implemented in stages rather than a single intervention. Early stages typically involve bandwidth throttling, unstable connections or selective blocking of platforms.

As protests intensify, authorities escalate by disabling mobile data, restricting broadband access and withdrawing routing information that allows Iranian networks to be reached from the global internet. Government directives instruct providers to shut down services and block routes to the outside world. This effectively removes Iran’s digital address from the global network.

In Iran this week, internet traffic monitoring indicates near-total isolation. Connectivity is reported to have fallen to around 1% of normal levels.

Enforcement is neither uniform nor static. Restrictions are reported to be geographically targeted at those neighbourhoods most prone to protest. They tend to be synchronised with mobilisation and are adjusted in real time as required. Communications disruption now extends beyond the internet to include mobile and landline phones and basic digital services. At this point, the objective is to immobilise information flow across the whole of society.

Shutdowns as a political tool

Authorities have repeatedly justified shutdowns as necessary for national security or cybersecurity. Yet analyses indicate such measures as ineffective against state-level cyber operations. What shutdowns primarily restrict is societal access to information and communication, both internally and externally.

The fact that Iran persists with shutdowns despite the often severe economic and humanitarian costs, shows how effective they judge them to be. Each blackout disrupts banking, payments, logistics and everyday life. Yet authorities repeatedly accept these costs when legitimacy risks threaten regime survival. Shutdowns thus function as coercive signals as much as technical means, demonstrating a willingness to suspend digital society itself.

VPNs are widely used in Iran to bypass censorship and surveillance. Research shows that VPN use is often tolerated outside crisis periods, operating as a managed pressure valve while allowing the state to keep an eye on the sort of people who use them. At the same time, VPN traffic is detectable, providers are routinely blocked or throttled, and legal ambiguity enables selective enforcement.

Crucially, VPNs depend on underlying connectivity. Once authorities escalate to disruption on an infrastructure level, VPNs become ineffective because tunnels (encrypted connections that carry internet traffic) cannot be established. This explains why VPN use is significantly reduced when shutdowns are imposed. The same holds for the Tor network (a decentralised system that routes internet traffic through multiple relays to obscure users’ identities and locations). This has been used by Iranians in the past.

Satellite internet, particularly Starlink, enabled limited information flows during recent shutdowns. This allowed some reporting to the outside world. By bypassing domestic infrastructure, satellite connectivity undermines territorial control over data flows – but access remains uneven because connectivity depends on equipment which is scarce, expensive and difficult to distribute discreetly.

Possessing or operating such equipment carries personal risk, particularly during periods of heightened repression. Even when available, connectivity is not guaranteed – satellite links can be degraded andobstructed, and are vulnerable to disruption through signal interference. As a result, satellite internet provides limited, uneven connectivity rather than a reliable substitute.

Shutdown conditions also create fertile ground for social engineering attacks. Fake “Starlink apps” and misleading claims about other circumvention tools can exploit citizens by harvesting data or identifying users.

Shutdowns are rarely the first choice for a regime like the Islamic Republic. They are deployed when mobilisation becomes rapid, visible, and difficult to contain. A recurring feedback loop follows: protesters adapt through VPNs or alternative channels, authorities escalate to infrastructure-level disruption, and this escalation fragments coordination while intensifying perceived injustice.

This explains why shutdowns may suppress mobilisation in the short term yet worsen instability over time. It’s a pattern that was evident across Iran’s previous blackouts.

When they feel under threat, regimes move from monitoring private communication to restricting information flows at scale. This trajectory underscores a broader warning for democracies: the erosion of privacy initiates a shift in power toward the state by normalising control infrastructures that can be activated during crises. This is a dynamic the Iranian case illustrates, manifesting in the disruption of communication itself.

The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.