Iran Today

The Digital Siege

by Iran Prism 12 min read

The Screen

Maryam ran an online clothing store from her apartment in Karaj. She had 43,000 followers on Instagram, a rented sewing machine, and a three-year-old daughter who modeled the children’s line. On the evening of January 8, she was not thinking about her business. She was thinking about the video on her phone — seven seconds of footage showing men in black firing from the roof of a bank into a crowd on Gohardasht Boulevard. She had filmed it from her balcony. Her hands were shaking. She opened Telegram, selected the video, and pressed send.

The progress bar reached fourteen percent. Then it stopped.

She switched to Instagram. The app would not load. She tried WhatsApp. Nothing. She restarted her phone. She restarted her router. She walked to the window and saw the streetlights still on, the electricity still running. The problem was not her power. The problem was that at 8:00 PM Iran Standard Time on January 8, 2026, the Islamic Republic of Iran severed internet access for approximately ninety million connected users — virtually the entire online population of a country of ninety-three million.

The seven-second video never left Maryam’s phone. Within the hour, the men on the rooftop were joined by others — in vehicles mounted with DShK heavy machine guns, in ambulances repurposed for abductions, in formations of foreign fighters who spoke Iraqi Arabic. By morning, the hospitals of Karaj would be overflowing with the dead and the dying.

The blackout and the massacre began at the same moment. This was not a coincidence. It was a doctrine.

The Doctrine

The regime had been studying its own failures for seventeen years.

In June 2009, a twenty-six-year-old philosophy student named Neda Agha-Soltan was shot by a Basij militiaman during the Green Movement protests. A bystander filmed her death on a Nokia phone.1 The forty-second clip reached YouTube within hours. Within days, Neda’s face was on the cover of every major Western newspaper. Governments that had been content to watch condemned the crackdown. The political cost of one viral video exceeded the cost of the entire protest.

The regime learned.

In November 2019, during the fuel-price protests, the state disconnected international internet gateways for approximately one week — a “blunt” disconnection that severed the country from the outside world. An estimated 1,500 people were killed during that blackout.2 When connectivity returned, the footage trickled out slowly, but the moment of maximum international pressure had passed. The world had moved on.

The regime learned again.

In September 2022, the death of Mahsa Amini in morality-police custody ignited the Woman, Life, Freedom movement. Videos of young women cutting their hair, of security forces beating teenagers, of Nika Shakarami’s broken body — these spread in real time via Starlink terminals, VPNs, and the Psiphon circumvention network. The international response was swift. The regime survived, but at an enormous cost in diplomatic and economic capital.

By January 2026, the Islamic Republic had arrived at a calculation: the political cost of a total blackout was lower than the political cost of visible atrocities. If the world could not see the killing, the world would not act in time to stop it.

Cut the cameras before pulling the triggers.

The Architecture

The 2026 shutdown was not the same blunt instrument as 2019. It was surgical — a protocol-level operation designed to keep the state online while the population went dark.

On the morning of January 8, network monitors at Cloudflare, Kentik, and the Internet Outage Detection and Analysis project detected a massive withdrawal of IPv6 address space from Iranian networks.3 This was the technical equivalent of clearing the decks — removing modern internet routing while keeping older IPv4 routes visible to the global routing table. The result was a system of granular whitelisting: state entities — government ministries, banks, security services — retained full connectivity. Civilian packets were simply dropped.

A tiered internet. The regime saw everything. Citizens saw nothing.

Deep Packet Inspection boxes — likely of Chinese origin — interfered with the TLS handshake, the cryptographic protocol that secures every HTTPS connection. When an Iranian attempted to reach a foreign server — WhatsApp, Instagram, a VPN node — the DPI appliances identified the TLS “Client Hello” packet and either dropped it or injected a TCP Reset signal. The user’s screen showed a loading bar that never completed. Not a “blocked” message. Not an error page. Just silence — a psychological tactic designed to waste time and induce confusion rather than galvanize outrage.

Then the regime did something it had never done before. It destroyed its own domestic internet.

Since 2019, Iran had invested heavily in the National Information Network — a domestic intranet designed to function independently of the global web. The NIN kept banking running, ride-sharing apps like Snapp operational, domestic messaging platforms alive. In every previous crackdown, the NIN stayed online to limit economic damage.

In January 2026, authorities severed access to the NIN as well. This “total scorch” policy accepted complete economic paralysis — the collapse of digital banking, the death of e-commerce, the paralysis of ride-sharing and delivery services — to prevent protesters from using any digital platform for coordination. The shift from managing unrest to eradicating it at any cost.

The Price of Silence

Daily GDP loss: $35.7M/day (regime’s own admission) | Financial transactions lost: 185 million (January alone) | E-commerce decline: -80% | Tehran Stock Exchange: -450,000 points in 4 days | Daily liquidity withdrawal: 130 trillion tomans

Instagram functioned as a primary e-commerce platform in Iran. Millions of small businesses — clothing sellers, food vendors, tutors, graphic designers — operated entirely through it. The blackout was not just censorship. It was an economic death sentence for the very working class whose grievances had started the protests.

The regime knew about Starlink. By January 2026, approximately fifty thousand terminals were active inside Iran — smuggled through Kurdish mountain borders and by “mosquito fleet” boats across the Persian Gulf.4 The Trump administration had covertly facilitated the delivery of roughly six thousand additional terminals in January alone.5 Possession had been criminalized in 2025 under legislation classifying satellite internet terminals as instruments of espionage, punishable by up to ten years in prison.

Fifty thousand terminals for ninety million people. The math was already impossible. But the regime intended to make even that trickle disappear.

Kalinka — dubbed the “Starlink Killer” — was a Russian-origin electronic warfare system transferred to Iran under the 2025 Strategic Partnership.6 It detected the electromagnetic signature of a Starlink user terminal and directed high-power jamming beams at the uplink frequencies. Alongside it, the Tobol system — originally designed to protect Russian satellites — was repurposed to jam Starlink’s downlink signals, effectively deafening the devices from the sky.

Then there was the spoofing. Starlink terminals rely on GPS to steer their phased-array antennas and track satellites moving at seventeen thousand miles per hour. Iran deployed widespread GPS “circle spoofing” using technology likely transferred from China — the same technology originally developed to hide oil tankers evading sanctions. Fake GPS signals caused terminals to calculate locations thousands of kilometers from their actual position. When a terminal thinks it is in Turkmenistan, it cannot point at the right satellite.

The result: packet loss rates of thirty to eighty percent in Tehran. Functionally unusable for video uploads — precisely the kind of traffic the regime most needed to suppress.

Physical raids completed the picture. Drones swept rooftops to detect the distinctive shape of Starlink dishes, guiding security forces to the homes of anyone brave enough to mount one. The hardware itself became a target. The person became a suspect.

Kalinka effectively disabled or degraded approximately forty thousand of the fifty thousand terminals during the height of the crackdown.7 The failure of technological salvation was complete — the era of “Starlink will set us free” ended on a rooftop in Tehran where a jammed dish pointed uselessly at a sky full of satellites.

The Human Bridge

The regime could jam satellites. It could sabotage protocols. It could raid rooftops. But it could not reach into the living rooms of four hundred thousand people scattered across Toronto, Los Angeles, Hamburg, and London.

Psiphon — a Canadian circumvention tool — became the lifeline. Approximately four hundred thousand Iranians abroad installed Psiphon Conduit on their personal computers, turning their home internet connections into bridge nodes for users inside Iran.8 Traffic was obfuscated and distributed across hundreds of thousands of residential IP addresses. The regime could not block this traffic without whitelisting the entire internet — which would defeat the purpose of the blackout.

The Psiphon army did not replace the internet for ninety million people. It created a trickle where the regime wanted absolute silence. And a trickle was enough for evidence.

In border provinces — Kurdistan, Sistan-Baluchistan — activists employed methods older than the internet itself. They hiked to mountain elevations where their phones could capture cellular signals from Iraqi or Turkish towers. They recorded footage on SD cards and USB drives. Kolbar couriers — the same cross-border porters who carry goods on their backs for a living — smuggled the drives out of the country hidden in vehicle linings and luggage. The footage was delayed by days. But it arrived in high definition, with metadata intact, ready for forensic verification.

The evidence that emerged from these channels — DShK fire on pedestrian crowds, hospital executions, mass graves at Behesht-e Rezvan — pierced the information blockade. Diaspora verification networks authenticated the footage. Satellite TV beamed it back into Iran. The regime’s twelve-day silence was broken not by billion-dollar satellites but by ordinary people who refused to let the killing happen in the dark.

The Void

The blackout did not just prevent information from leaving Iran. It created a vacuum inside the country — and the regime filled it.

State television became the only source of news for ninety million people. The IRGC Intelligence Organization broadcast a single narrative: the protests were not protests at all. They were the “continuation” of the 12-Day War between Iran and Israel in June 2025. The same enemy that had bombed Natanz and Fordow was now using “human agents” to destroy the country from within.

The official IRGC statement: “The American-Zionist conspiracy of January was the cowardly revenge of the enemies of the Iranian nation for the defeat in the 12-Day War.”

This framing performed a specific function: it delegitimized economic grievances. The rial’s collapse, the elimination of fuel subsidies, the evaporation of the middle class — none of this existed in the regime’s narrative. There were only foreign agents, saboteurs, and the patriotic security forces defending the nation.

Protesters were classified as “rioters,” “mercenaries,” and “terrorists affiliated with US and Israeli governments.” State television broadcast forced confessions — detained protesters reading prepared statements admitting they had received funds and weapons from foreign intelligence agencies. A historical pattern deployed at industrial scale.

The official death toll was set at precisely 3,117. The non-rounded specificity was itself a psychological tactic — the simulation of transparency. The majority of the dead were classified as “martyrs” (security forces), the remainder as “terrorists.” A fabrication designed to obscure a real death toll an order of magnitude higher.

The Numbers Behind the Silence

Iranian government official toll: 3,117 | Health Ministry leak (to TIME): 30,000+ killed Jan 8-9 alone | Doctors’ clinical tally: 30,304 in civilian hospitals (excludes military) | Iran International estimate from leaked IRGC documents: 36,500 | HRANA verified identities: 6,634+

For the millions of Iranians without internet access during those twelve days, state media’s framing was the only framing. Many initially believed the “foreign conspiracy” narrative — not because they were credulous, but because no alternative information existed. The regime’s narrative warfare partly worked precisely because the blackout made it the only voice in the room.

The Supply Chain

The blackout was not built in Iran.

The surveillance cameras lining Tehran’s highways — the ones that used facial recognition to identify unveiled women, auto-mail fines, and impound vehicles — were manufactured by Tiandy and Hikvision, Chinese companies whose “ethnicity tracking” algorithms were originally developed for the repression of Uyghurs in Xinjiang.9 The Nazer app, which encouraged regime loyalists to photograph and report “improperly veiled” women, had effectively conscripted citizens as surveillance agents against one another for years before January 2026. When the protests began, this infrastructure — built to control women’s bodies — was repurposed for mass identification of demonstrators.

Gender apartheid was the beta test for totalitarian digital control.

The National Information Network was modeled on China’s Great Firewall, with Huawei providing core infrastructure. China encouraged Iran to adopt the BeiDou navigation system, reducing dependence on GPS — and enabling the GPS spoofing attacks on Starlink. The Russian electronic warfare systems — Kalinka and Tobol — arrived under the 2025 Strategic Partnership. Mobile jamming units deployed to specific neighborhoods mirrored Russian tactical doctrine in Ukraine, suggesting direct advisory support.

Iran 2026 was the proof of concept. Chinese surveillance architecture plus Russian electronic warfare plus state-controlled deep packet inspection equals the ability to turn off ninety million people’s internet while keeping the security apparatus online. The model is field-tested. It is exportable. And the buyers are watching.

The Honest Ledger

The blackout was devastating, but it was incomplete. Starlink terminals did allow some critical evidence to escape — enough to eventually document the scale of the massacre. The Psiphon network, the kolbar couriers, and the diaspora verification infrastructure ensured that the regime’s silence was temporary, not permanent.

The exact capabilities of Kalinka and Tobol are partially inferred from observed effects rather than confirmed specifications. The fifty-thousand-terminal estimate for Starlink comes from intelligence community sourcing, not independent verification. Russia and China may have provided technology opportunistically — for profit — rather than as part of a coordinated authoritarian strategy.

The Psiphon army’s effectiveness was real but should not be romanticized. Four hundred thousand bridge nodes created a trickle, not a river. They did not restore mass connectivity for a nation of ninety million. They allowed fragments of evidence to escape — fragments that proved decisive for international documentation but arrived too late to prevent the killing.

And the regime’s narrative warfare partly succeeded. During those twelve days of silence, millions of Iranians with no access to alternative information accepted the state’s framing of protesters as foreign agents. The damage to social trust — neighbor suspecting neighbor — may outlast the physical wounds.

Consider what it would mean to lose every source of news except one — controlled by the people you were protesting against — and to have no way of knowing whether your neighbor, your cousin, your coworker had survived the night. That is what ninety million people experienced for twelve days.

What January 2026 proved is this: authoritarian regimes have entered the era of the controllable internet. Authoritarian regimes have built the technical and military capacity to sever their populations from the world, jam the satellites meant to save them, and fill the void with their own voice. The real resistance was not technological. It was human — four hundred thousand people who turned their living rooms into relay stations, and couriers who carried memory cards through mountain passes, because they believed that what happened in the dark deserved to be seen.

The authoritarian technology supply chain behind the blackout is explored in The Splinternet. The diaspora network that pierced the information blockade is documented in The Psiphon Army. The regime’s war against the journalists who broadcast the evidence is told in The Assassination Bureau.

Footnotes

  1. Amnesty International, “What Happened at the Protests in Iran?,” January 2026 ↩

  2. Amnesty International, “What Happened at the Protests in Iran?,” January 2026; Wikipedia, “Internet Censorship in Iran,” accessed February 2026 ↩

  3. Cloudflare Blog, “Route Leak Incident on January 22, 2026”; Filterwatch, “Total Blackout: A Technical Breakdown of the January 2026 Shutdown,” January 16, 2026 ↩

  4. IranWire, “Why There’s No Starlink Access During Nationwide Shutdown in Iran?,” January 2026; The Guardian, “An Ecosystem of Smuggled Tech Holds Iran’s Last Link to the Outside World,” January 13, 2026 ↩

  5. Jerusalem Post, “US Delivered Starlink to Thousands amid Regime Crackdown,” February 2026 ↩

  6. United24 Media, “Iran Reportedly Tested Russian Electronic Warfare Against Starlink During Mass Protests,” January 2026 ↩

  7. IranWire, “Why There’s No Starlink Access During Nationwide Shutdown in Iran?,” January 2026; Georgia Tech, “Iran’s Latest Internet Blackout Extends to Phones and Starlink,” January 16, 2026 ↩

  8. Iran International, “Volunteers Abroad Deploy Tech to Pierce Iran’s Internet Iron Curtain,” January 24, 2026 ↩

  9. Article 19, “Tightening the Net: China’s Infrastructure of Oppression in Iran,” February 2026; The Guardian, “Chinese Technology Underpins Iran’s Internet Control, Report Finds,” February 9, 2026 ↩