A Calculated Choice: Why Iran Kept the Internet Partially Online During Recent Protests

The nationwide protests of January 2026 mark a critical moment in the political and social history of the Islamic Republic of Iran. Triggered by a sharp collapse of the Rial and surging inflation, the demonstrations quickly moved beyond economic grievances to challenge the political system itself.

Yet amid the intensifying security response, one notable departure from past practice has stood out. Unlike during the November 2019 protests ("Bloody Aban") or the 2022 "Woman, Life, Freedom" uprising, authorities have refrained from imposing a total, nationwide internet blackout.

Instead, available technical and field evidence points to the use of what analysts describe as "engineered degradation." This approach relies on layered disruptions, a severe reduction in international bandwidth, and targeted attacks on encrypted infrastructure such as Cloudflare, rather than a complete severing of Iran's connection to the global internet.

This shift does not reflect political openness or reformist intent on the part of President Masoud Pezeshkian's government. Instead, it results from structural constraints that make a complete shutdown increasingly risky for the system's survival.

Why a Total Shutdown Has Become Costly

Economic fragility

By 2026, following the brief but intense conflict in June 2025 and the continuation of international sanctions, Iran's economy has become exceptionally vulnerable. A complete internet shutdown would risk tipping an already fragile livelihood crisis into an uncontrollable collapse.

The Starlink factor

The growing presence of satellite internet has undermined the state's monopoly over information flows. With thousands of Starlink terminals reportedly active inside Iran, a nationwide blackout would no longer produce an information vacuum. Instead, it could accelerate a shift toward unfilterable satellite connections beyond the government's control.

Internal legitimacy and political rifts

The exposure of so-called "white SIM cards," which allow officials unfiltered internet access, has deepened public resentment and created visible divisions within the political elite. In this context, reverting to a blanket shutdown would carry high political costs.

Anatomy of the January 2026 Crisis: From Economic Collapse to Political RevoltEconomic Roots and the Nature of Protests

The protests of January 2026, which entered their tenth day on January 6, differ from previous waves in both scope and motivation. 

While sparked by currency instability and a soaring dollar rate, they rapidly evolved into a broader political revolt. Unlike 2022, where the focus was on social freedoms, the primary driver here is "survival."

Analysts say Iranian society has entered a "survival phase," marked by the erosion of the middle class and a convergence between the urban poor and traditional bazaar merchants. Demonstrations have spread from major cities such as Tehran, Isfahan, and Shiraz to smaller towns, including Izeh, Kuhdasht, and Fuladshahr. 

Slogans have moved past "the Dollar," with cries of "Death to the Dictator" and monarchist slogans ("Reza Shah, bless your soul") echoing in the heart of Tehran's Grand Bazaar.

Physical Repression Continues

While the internet remains partially functional, the security response on the ground has been severe. Reports from western provinces, including Lorestan, document the use of live ammunition against protesters. As of January 6, at least 21 to 29 deaths had been reported, with over 1,203 arrests.

Senior officials, including Mohammad Bagher Ghalibaf and Gholam-Hossein Mohseni-Eje'i, have sought to rhetorically distinguish between "protests over high prices" and what they label "political rioting." 

Observers see this distinction as an attempt to prevent economically anxious but undecided segments of society from joining the protests.

A New Model of Digital Suppression

Technical data suggest a deliberate move away from the "kill switch" model used in previous crises.

Measured disruption

Data from Cloudflare Radar indicates that total internet traffic has dropped by approximately 35% since early January, not due to physical disconnections, but to throttling of international bandwidth and restrictions on specific protocols.

Targeting VPN infrastructure

Authorities have focused on disrupting content delivery networks such as Cloudflare, which many advanced VPN services (such as V2Ray and VMess protocols) rely on. By degrading access to this infrastructure, the state has reduced VPN effectiveness without triggering a total blackout. 

As a result, platforms like Instagram and WhatsApp have become challenging to use, while domestic banking and administrative services remain operational.

Selective access

Mobile internet, the primary tool for protest coordination, has faced the harshest restrictions. Fixed connections (ADSL and fiber optic) used by businesses and offices have been less affected, allowing economic activity to continue at a minimal level.

Reliance on domestic infrastructure

The expansion of Iran's National Information Network has enabled essential services, such as banking, ride-hailing (Snapp, Tapsi), and e-commerce (Digikala), to operate independently of the global internet. This relative independence from the World Wide Web has allowed authorities to narrow international access while keeping daily life running.

The Economic Logic of Connectivity

In contrast to 2019, Iran’s economy in 2026 lacks resilience. With a large budget deficit and triple-digit inflation, each hour of internet disruption carries high economic costs.

Reports estimate that internet disruptions in previous years cost approximately $1.5 million per hour. In 2025, disruptions caused by war and security policies cost the country at least $12.7 billion in lost industrial and service revenue

Communications Minister Satar Hashemi acknowledged that the livelihoods of over 10 million Iranians now depend directly on the digital space.

Cutting connectivity risks bankrupting small merchants and service providers—groups that have already played a central role in the current protests.

Starlink and the End of Monopoly

Satellite internet represents a structural challenge to state control. Security analysts know that a "kill switch" is the best advertisement for Starlink. 

A complete shutdown would likely drive more users toward Starlink, even at high black-market prices, while depriving authorities of the ability to monitor traffic through conventional surveillance tools.

Political Fragility and Credibility

The exposure of unequal internet access has intensified perceptions of "class-based internet" or “digital apartheid.” 

President Pezeshkian, who campaigned on easing restrictions, faces pressure from both hardliners and a public increasingly skeptical of official narratives. A total shutdown would further erode his remaining credibility.

The Trump Factor

The return of Donald Trump has increased the risk of overt suppression. 

Trump warned on Truth Social that if Iran kills protesters, the U.S. is "locked and loaded" to intervene. 

For a regime that recently survived a 12-day military conflict with Israel, any excuse for foreign intervention is dangerous.

Cybersecurity and Defense-in-Depth

A total internet blackout, while disconnecting protesters, also blinds the regime's own monitoring systems against foreign cyberattacks. 

In an environment where the threat of Israeli or American cyberattacks on critical infrastructure (oil, electricity, nuclear) is high, maintaining network connectivity is essential for "cyber readiness."  

A self-imposed blackout could provide the perfect cover for enemy cyber-strikes to hit without being traced.

Conclusion: A Strategic Impasse

The decision not to cut the internet is not a sign of moral restraint but strategic paralysis. Analysts describe the situation as a “dictator’s trilemma” in the digital age:

A total shutdown risks economic collapse and accelerated adoption of satellite internet.An open internet enables faster protest coordination and political collapse.Partial connectivity—engineered degradation—offers control at a high and growing cost.

For now, authorities have chosen the third option. But with the Rial continuing to fall and alternative technologies spreading, that balance appears increasingly unstable. The internet remains on, not by choice, but because turning it off may now pose a greater threat to the system than leaving it partially connected.