The Iranian Government Censors the Internet and Sells Circumvention Tools

The following article was written by a citizen journalist based in Iran who uses a pseudonym to protect his identity

Iran’s Supreme Council for Cyberspace has announced plans to legalize virtual private networks (VPNs), software that allows people to bypass blocked websites. Although there are no stipulations for VPNs under Iranian law, using them is not illegal, and the recent move signals an attempt for the government to gain more control over its citizens.

The announcement of the new legislation came from Abolhassan Firouzabadi, the council’s secretary, on November 11. If passed, it will make it possible for authorities to gain even greater access to VPN users’ personal information. Firouzabadi's announcement is also an implicit admission that Iran’s security agencies already have access to such information.

Firouzabadi said the council and the prosecutor’s office had drafted legislation that would license VPN companies in order to regulate sales of the software across the country. This followed controversial statements from the Minister of Communication and Information Technology, who used a speech in parliament to warn against VPN sales being controlled by a “mafia” — prompting widespread debate on social media. 

Creators of circumvention tool Psiphon had previously stated that Iran has had the most advanced internet filtering system in the world, and it is well known that millions of Iranians use anti-filters or VPNs to access the country’s most popular sites and apps that are filtered and blocked in Iran by the Supreme Council for Cyberspace, the judiciary, and the Ministry of Communication and Information Technology, including Telegram, Twitter, Facebook and news websites. Many of these anti-filters have performed less well in recent months, and many have been disabled, prompting many people to buy VPN products, some of which have been advertised on Iranian domestic websites. VPN software can also be purchased in stores across Iran.

Although many people seek out these sites with the intention of purchasing VPN software, there are many who are inadvertently directed to these sites without actually planning to buy, and the advertised sites are likely to have endorsement from the government. Once people agree to buy (although some of them might not be fully aware of what they’re buying), they are directed to a payment section of the site, pay for a certain amount of time and start using the VPN.

But how can it be that a website with a domain in Iran can take customers’ money and sell them VPNs — allowing them to essentially commit an offence as stipulated under Iranian law? How do these companies avoid getting into trouble when they are selling a product that, while not strictly illegal, facilitates access to material that is? Now that the Supreme Council has effectively endorsed the sale of VPNs, the issue has become even more baffling. Are VPNs the evil work of mafias? Or are they viable pieces of software to which the public should have access?

VPNs: Controversial Support for Iran Tech and Banking Industries 

In addition to VPNs being widely used by the public, two key sectors in Iran benefit from their sale: the communication infrastructure and the banking system. This means that Iranian regulatory and intelligence agencies have access to information about people, groups and companies who buy or sell anti-filter or circumvention software.

Firouzabadi said that plans for legalization had been on the council’s agenda for some time, and denied that the move had met with opposition. Instead, he said, implementation of the new policy had been delayed. "In cooperation with the prosecutor's office, a regulation has been prepared, which, given the huge economy that this service has created in the country and the responsibilities of the prosecutor's office and the ministry of communications, we hope will create VPN sales operators and legalize this service in the country.”

He unveiled plans for regulation so that VPNs could only be offered by approved retailers, and confirmed that the Supreme Council for Cyberspace had agreed with the Ministry for Information and Technology Communications on allowed levels for filtering and the classification of access levels, therefore setting out that access to information would be different according to each access level.

An example of a shared VPN card currently sold in Iranian shops

In recent years, the Islamic Republic has accelerated the creation of a national information network — referred to by some as a “halal internet” — in order to curb people's access to the internet, especially after President Hassan Rouhani took office and the appointment of Mohammad Javad Azari Jahromi as the minister of communications. So as the country prepares to overhaul its policy on VPNs, it is also taking further steps to create a North Korean-style internet — known to be the most closed and restrictive in the world. 

Currently, in Iran, the use of filters and VPNs is not actually considered a crime, but if security or intelligence agencies discover an individual or group using them to access banned sites or networks, they are liable to face charges. With the recent announcement from the Supreme Cybersecurity Council comes concerns that legalization of state-endorsed VPNs will mean that people using software not approved by the government, including VPNs manufactured and sold from abroad, could not only face restricted access to these tools, but also criminal charges for using them. Millions of citizens are currently using VPNs that are unlikely to get governmental approval. 

Ultimately, the council has set out its plans for the future of the internet in Iran: Restricted and monitored access to the internet, most likely limited to people of a certain social status and the political elite. This will mean little change to the status quo, where the regime commands rigorous control over its people and the information they can access. The Iranian public, which already has to endure one of the world’s slowest and most restricted internets, will be subject to greater scrutiny and control, bound by the Islamic Republic's domestic and legal VPNs.

Mohsen Sepehri, Citizen journalist