Offline by decree: Iran’s war on the internet
In wartime Iran, connecting to the internet is now a perilous act, viewed as a crime against the state. Since hostilities erupted between Iran, Israel, and the United States on 28 February 2026, authorities have unleashed one of the most comprehensive internet shutdowns in history, cutting off millions from the rest of the world.
Iranian authorities are now warning citizens that sharing photos of bombed locations or even trying to access the global internet could get you prosecuted for “collaborating with the enemy”. Against this backdrop, using a search engine or VPN is no longer innocent – it can be seen as a threat.
Following massive airstrikes that killed the Supreme Leader and senior commanders, the state responded not only with anti-aircraft fire, but also activated a “kill switch” – severing international internet infrastructure. According to NetBlocks, connectivity dropped to just 1% of normal levels. For more than 280 hours, 90 million people have endured enforced silence, with over 40% of 2026 so far (up to 10 March) spent under internet shutdown. This calculated effort intends to isolate the population from information, not just a simple malfunction.
A text message from an Iranian mobile operator calling on users to report people sharing images or information
In a climate of heightened state paranoia, the SMS has become a tool of direct psychological warfare. Most frequently, messages from mobile operators to Iranian users characterise the sharing of images from bombing sites or “anti-government” sentiment as a “security violation”, effectively deputising mobile phones as tracking devices for dissent.
More alarming are the rare reports of messages carrying direct judicial weight. These warn that “repeated connection to the international internet” will result in the immediate suspension of the phone line and referral to the judiciary. By criminalising attempts to bypass a firewall, authorities equate digital access with espionage. Notably, while these systems are used to threaten citizens, they have remained silent when issuing air-raid or public safety warnings.
The architecture of the “class-based internet”
The blackout is not total. Instead, authorities have enforced a “whitelisting” system that grants global web access only to pre-approved, loyal users.
This system works because Iran has built its own internal internet, separating local traffic from the rest of the world. When the government turns on the whitelist, most people can only use local sites, while a small, approved group can still access the global internet. Instead of just blocking certain websites, the government now blocks most people entirely, letting only trusted insiders through.
On 10 March, government spokesperson Fatemeh Mohajerani – representing an administration that, ironically, had campaigned on a pledge to reduce filtering – confirmed this graded reality. She stated that the government is working to provide limited access specifically for those who can “convey the voice of the system to the world”. This allows the regime to dominate the narrative reaching the outside world, drowning out civilian experiences with state propaganda.
The digital underground: Configs and cat-and-mouse
Despite threats, the Iranian people have not surrendered their right to speak. An underground network of “configs” now sustains resistance.
Software like V2Ray, Xray, or Trojan is essentially an engine that does nothing on its own. To function, they require a specially formatted text file that specifies which server, protocol, and path to use. What users receive as links or files in private Telegram channels are actually encoded versions of these settings. Because the state’s deep packet inspection technology is constantly hunting for these connections, these files often have a very short lifespan.
The challenge of keeping connections alive has created a high-risk black market. Short-lived configs are bought at high prices, making communication expensive and risky.
For many users, especially those with limited technical knowledge, the situation creates new vulnerabilities. People searching for a way to contact relatives abroad often rely on unknown sellers or unverified software, exposing them to scams, malware, and surveillance risks.
Some turn to Starlink, but owning such hardware adds further dangers of arrest and confiscation.
Doxing as statecraft: The “spy hunters”
The crackdown isn’t just online. Some Telegram channels linked to security forces now encourage people to report on each other, calling it an effort to find spies.
These channels employ open-source intelligence tactics to identify citizens. When a video of an airstrike is posted, these groups inspect metadata and visual details to pinpoint the photographer’s location. Their personal information is then exposed, and they are labelled as enemy collaborators. This vigilante-style digital hunting is supported by the highest levels of the judiciary. Chief Justice Gholam-Hossein Mohseni-Ejei has publicly warned of “no leniency”, while state television has discussed punishments ranging from property confiscation to the death penalty for media actions that “damage national security”.
The humanitarian cost of silence
The human rights implications are catastrophic. Human Rights Watch has warned that the shutdown violates international law. When the IDF issues evacuation warnings on social media, those warnings fall into a digital vacuum. Because the general population cannot access the global web, they cannot see the maps or the warnings intended to save their lives.
Centuries ago, the Persian Empire pioneered the Chapar-khaneh, a sophisticated postal system that revolutionised communication. Today, the heirs of that civilisation are being forced into a digital dark age. This is not the first time a nation has been stripped of its right to the global digital commons, nor will it be the last. But this crisis must serve as a provocation for the next generation of internet giants.
As satellite-to-mobile technology advances, internet providers face the question of whether global access should be guaranteed in places where governments restrict connectivity. Preventing the criminalisation of communication may require new technical solutions. Securing open access remains a challenge for the global community.