Infrastructure of Silence – PART I

How the Ruling Regime in Iran Built a System of Enforced Digital Isolation

In 2025 and 2026, the ruling regime in Iran transformed internet disruption from a temporary censorship tactic into a wider system of political control. Restrictions were no longer limited to short interruptions during moments of unrest. They became part of an expanding infrastructure of enforced isolation: prolonged shutdowns, severe throttling, selective access, criminalization of alternative connectivity tools, and centralized control over the country’s digital gateways.

This report focuses on the recent period, particularly the disruptions recorded during 2025 and 2026, including the January 2026 blackout during nationwide protests and the shutdown that began on 28 February 2026. It examines these restrictions not as isolated technical incidents, but as instruments of repression, concealment, economic pressure, selective privilege, and social fragmentation.

According to NetBlocks, by 6 May 2026 Iran’s internet blackout had entered its 68th day, exceeding 1,608 hours of restricted connectivity. This figure is central to understanding the scale of the crisis. The blackout was not a brief interruption. It was a prolonged condition imposed on millions of people, affecting communication, livelihoods, healthcare, independent reporting, emergency access, and the ability of families to share information about killings, arrests, and disappearances.

The regime’s policy also created a sharp divide between ordinary citizens and politically protected users. While the public faced degraded or nearly absent access to the global internet, reports pointed to privileged connectivity for selected state institutions, security-linked actors, approved media outlets, and politically connected groups. This selective access system, often discussed through references to “white SIM cards,” “Internet Pro,” and tiered connectivity channels, has turned internet access from a public utility into a politically mediated privilege.

At the same time, authorities moved to criminalize alternative means of reaching the outside world. Statements by legal figures and state-aligned media show that satellite internet tools, including Starlink-type equipment, have been framed not as emergency communication devices, but as potential instruments of espionage or action against the state.

The evidence points to a broader pattern: digital restrictions in Iran are being used not only to silence online speech, but to control visibility, delay accountability, punish economic independence, and prepare the ground for future repression away from public scrutiny.

From Shutdown to Infrastructure: The Expansion of Enforced Isolation

The shutdowns and disruptions recorded during 2025 and 2026 show a shift from episodic censorship to structural digital isolation. Earlier internet restrictions in Iran were often described as temporary responses to unrest. The recent pattern is different. Restrictions have lasted for weeks and months, with the public repeatedly deprived of stable access to the global internet.

The January 2026 blackout began amid nationwide protests and rapidly became one of the most severe disruptions recorded in Iran. Cloudflare observed Iran’s traffic collapsing by nearly 90 percent on 8 January 2026 before dropping to effectively zero. IODA measured active-probing responsiveness at approximately 3 percent, indicating that only a tiny fraction of normally reachable infrastructure remained responsive from outside the country.

The February 2026 blackout further demonstrated the maturity of the shutdown architecture. Beginning on 28 February 2026, traffic reportedly fell to well under 1 percent, while IPv4 and IPv6 route announcements remained broadly stable. This distinction is critical. The available technical evidence does not support describing these incidents as classic BGP hijacking. The better-supported finding is that the restrictions were mainly implemented through aggressive filtering, throttling, whitelist-based access control, protocol interference, and gateway-level disruption.

In other words, the regime did not always need to make Iranian networks disappear from the global routing system. It could keep routes visible while making the global internet practically unreachable for ordinary users.

The National Information Network and centralized gateway controls are central to this model. They allow domestic services and state-approved platforms to remain partially functional while access to the open internet is severely restricted. This creates an internal communication environment in which banking, official services, and approved domestic platforms may continue, while cross-border communication, independent media access, secure messaging, and evidence transmission are suppressed.

The result is not simply a shutdown. It is a system of managed visibility.

Technical Indicators: Filtering, Whitelisting, and Protocol Suppression

The strongest technical evidence from 2025 and 2026 points to a layered model of disruption. The available record supports four main findings.

First, traffic collapsed while routing often remained visible. During the February 2026 blackout, Cloudflare observed traffic falling to well under 1 percent, while IPv4 and IPv6 announcements remained broadly stable. This pattern indicates that the blackout was not primarily carried out through a classic route withdrawal or public BGP hijack. Instead, it appears to have relied on filtering and whitelisting at centralized or gateway-level control points.

Second, active-probing measurements confirmed near-total unreachability. IODA reported active-probing responsiveness around 3 percent during the January 2026 and prolonged February 2026 disruption periods.

Third, protocol-level interference appeared before or during the shutdowns. Cloudflare observed that HTTP/3 and QUIC usage on major Iranian networks had already collapsed in the days preceding the January 2026 blackout, falling from around 40 percent to below 5 percent. This is consistent with intensified filtering, protocol suppression, or pre-shutdown whitelisting measures.

Fourth, selective access remained available for certain users and services. Monitoring and reporting from the prolonged 2026 blackout period indicated that some domestic services and limited privileged access channels remained functional. References to “Internet Pro,” “tiered access,” and selected network-level exceptions suggest that the system was not designed simply to disconnect everyone equally.

This technical pattern is essential for the human rights analysis. A shutdown based on filtering, throttling, whitelisting, and gateway controls is not a random technical failure. It is evidence of coordinated capacity to control who can communicate, what services remain reachable, and which information can cross the border.

Chronology of Recent Major Disruptions

This chronology shows a consistent pattern: major political or security crises were accompanied by severe restrictions on communication.

Selective Connectivity: From Public Right to Political Privilege

One of the most important features of the recent period is the expansion of selective connectivity. While ordinary people experienced severe restrictions, some institutions and individuals reportedly retained more stable or less restricted access to the global internet.

Public discussions inside Iran have repeatedly referred to “white SIM cards,” privileged access channels, and special internet services for selected groups. These terms describe a system in which the general public faces filtering and disruption, while approved users maintain access to communication tools and global platforms.

This model produces a hierarchy of digital rights. Ordinary citizens are treated as security risks. State institutions, security-linked actors, regime-aligned media, selected officials, and politically trusted users are treated as entitled to greater access.

The deeper problem is that access to information becomes conditional on political trust. When connectivity is distributed according to institutional or security status, the internet is no longer treated as a public good. It becomes a tool of loyalty management.

Selective connectivity also strengthens state propaganda. If regime-aligned media and officials retain access while independent journalists, activists, families, and ordinary users are cut off, the official narrative becomes easier to circulate and harder to challenge.

The emergence of selective access must therefore be understood as part of the broader architecture of silence. It does not merely restrict the public. It empowers the state and its aligned networks to speak while others are forced into silence.

Conclusion to Part I

The shutdowns imposed in Iran during 2025 and 2026 reveal more than a pattern of temporary censorship. They demonstrate the emergence of a structured system of enforced digital isolation built on centralized control, filtering, throttling, selective access, and managed visibility.

This architecture allows the ruling regime in Iran to disconnect society from the outside world while preserving privileged connectivity for approved actors and maintaining selected domestic functionality. The result is a controlled communication environment in which visibility itself becomes politically regulated.

Part II examines how this infrastructure has been reinforced through criminalization, official security rhetoric, economic pressure, restrictions on journalism, and practices that interfere with accountability and fundamental human rights.