How Iran Cut Its Digital Lifeline and Why They Did It With the Russian Scissors
By Anastasiia Hatsenko, Digital authoritarianism and Russian disinformation analyst
In late December 2025, wide-scale demonstrations broke out across Iran. What began as protests over increases in the prices of basic foodstuffs and the country’s staggering annual inflation rate has escalated into anti-government demonstrations that directly challenge Supreme Leader Ayatollah Ali Khamenei. The governmental response to the protests has led to one of the most comprehensive shutdowns of the Internet in the country’s history.
What distinguished this blackout from previous disruptions was not only its scale, but its sophistication: the shutdown relied on advanced traffic-control and signal-jamming capabilities that closely resemble technologies and tactics previously deployed by Russia, suggesting that Iran’s ability to silence the Internet now reflects a shared authoritarian playbook rather than an improvised domestic response.
Historical pattern
Over the past decade, the Iranian government has repeatedly used digital blackout as a valuable instrument of control during moments of political unrest. The first step was made in 2010, following the 2009 protest, by ratifying the Computer Crimes Law. It enabled the establishment of legal regulation for Internet control and censorship. For example, Article 10 makes the use of encrypted Internet communications a criminal offense, arguing that encryption can be used to bypass state surveillance and prevent authorities from detecting violations related to online expression.
However, the most striking precedent occurred in November 2019, when the authorities imposed a nearly total shutdown for five days. The most alarming aspect of this case was that people were cut off from the global Internet while domestic networks within the country continued to function relatively normally. It means that the Iranian government successfully managed to isolate its citizens from the world without completely blocking access to the Internet. Smaller but still significant shutdowns and throttling episodes followed in subsequent years, including targeted disruptions during protests and periods of heightened political tension. Taken together, these incidents demonstrated a clear pattern: when expressions of disagreement intensify, access to the Internet becomes restricted.
The latest blackout began on January 8, 2026, and is already one of the longest nationwide Internet shutdowns in history. As of this writing, the blackout is spanning its 12th day. According to Cloudflare Radar, Internet traffic began to collapse around 16:30 UTC (20:00 local time), dropping by nearly 90% within 30 minutes. Mobile connectivity failed nationwide, followed by sharp declines in fixed broadband access, indicating a centrally coordinated shutdown rather than isolated outages. The disruption initially extended even to state institutions, including the Ministry of Foreign Affairs. However, access was selectively restored to key government bodies and economic services such as banking systems and fuel payment processors.
Why and how?
Iranian authorities presented the January 2026 Internet shutdown as a matter of national security and response to an external “terrorist operation” threat. Similar justifications have also been used during previous shutdowns, framing access to the communication platforms as a tool for coordinated disorder. In reality, by cutting Internet access, authorities reduced protesters’ ability to organize, share information, and document abuses in real time. Iranian civil society organizations and activists report that the number of people killed as a result of government actions continues to rise, with estimates ranging from 3428 to 12,000. The blackout limits the flow of images and testimonies to international media and human rights organizations, creating an information vacuum inside the country and shielding state actions from external dissatisfaction.
From a technical perspective, the effectiveness of the shutdown relied on Iran’s highly centralized Internet architecture and its long-term development of the National Information Network, a state-controlled domestic Internet designed to function independently from the global web. This infrastructure allows authorities to intervene at key points in the country’s Internet routing system. One of the simplest and most effective methods to disrupt connectivity at scale is to block users’ IP addresses, the unique network identifiers that enable devices to send and receive data online. By restricting these routing mechanisms at national-level gateways, authorities were able to rapidly sever connections between Iranian users and international networks. Network data showing a rapid and uniform collapse in connectivity across multiple providers suggests that such controls were applied centrally rather than through localized disruptions. This capability is often described as an Internet “kill switch”: the ability to quickly sever access to the global Internet while keeping domestic infrastructure intact.
When access to conventional Internet networks was cut, satellite Internet service Starlink, which the Iranian government has declared illegal, became one of the few remaining ways to communicate with the outside world. Its main advantage is that Starlink does not rely on cables or local Internet providers. Instead, it operates through a constellation of low-Earth-orbit satellites that communicate with user terminals using radio frequencies and satellite navigation systems, including GPS. Disrupting Starlink does not require disabling the satellites themselves. Authorities can instead interfere with the system by jamming the signals used to transmit Internet data or the satellite navigation signals that Starlink terminals need to function properly. Signal jamming works by emitting powerful radio interference on the same frequencies used by satellite communications, overwhelming or distorting the signal so that data can no longer be transmitted reliably. In the case of Starlink, such interference does not completely switch the system off but can prevent terminals from connecting properly or significantly reduce performance in affected areas.
These efforts highlight the escalating nature of Iran’s digital controls. As protesters and activists turned to alternative technologies to stay online, the state expanded its tools beyond traditional Internet shutdowns, attempting to close even those channels that operate outside its domestic network infrastructure.
Russia’s technological footprint
The technical sophistication of this Internet shutdown in Iran has drawn attention not only to domestic capabilities but also to the external help that may have shaped them. Multiple investigations and analyses suggest that the technologies used closely resemble techniques previously deployed by Russia. While no publicly available evidence confirms the direct deployment of Russian technologies during the Iranian shutdown, the similarities point to its possibility.
Russia has spent years developing its “sovereign Internet”, an architecture designed to allow the state to isolate its national network from the global web, and has experience of blocking Internet connection in Russian cities for days and even weeks. A key component often associated with Russia’s approach to Internet control is deep packet inspection (DPI). DPI allows network operators to examine not only where Internet traffic is going, but also what kind of data it contains. In practice, it allows them to restrict encrypted messaging services, filter social media traffic, and track patterns of online behavior. According to the Foreign Policy report, some Russian companies helped Iranian mobile operators integrate DPI into Iran’s communications interception system.
Beyond traffic analysis, Russia has also developed a range of radio-electronic warfare (REW) systems designed to disrupt communications and satellite-based technologies. Among the best known is Krasukha-4, a mobile electronic warfare system originally designed to interfere with radar and satellite communications. Another system, Tirada-2, was designed to neutralize satellite communications, while Murmansk-BN conducts radio reconnaissance, interception of enemy signals and their suppression across the entire shortwave range at distances of up to 5,000 km.
These systems were developed for military use, but the underlying principles, such as disrupting signals, degrading satellite links, and interfering with navigation and communication channels, are increasingly relevant in civilian contexts. The techniques reportedly used to interfere with Starlink in Iran, including signal and navigation disruption, resemble methods previously observed in Russian electronic warfare operations, particularly in Ukraine. While there is no public evidence that these specific systems were deployed in Iran, the overlap in capabilities is significant. The combination of DPI and radio-electronic interference for satellite communications reflects a comprehensive approach to information control that Russia has refined over the years and that appears to be informing similar strategies elsewhere.
Conclusion
Iran’s January 2026 Internet shutdown was more than a temporary response to the protests. It reflected an immediate effort to suppress dissent at a moment of nationwide protest, while also revealing the results of a longer-term work to consolidate digital control. The resemblance of these methods to technologies and tactics previously deployed by Russia suggests that Iran’s approach is not developing in isolation, but is shaped by a shared model of digital repression that blends surveillance, network control, and electronic warfare techniques. Looking ahead, the implications extend well beyond Iran. As states refine their ability to control both “ground-based” Internet networks and satellite communications, shutdowns are becoming more targeted, resilient, and difficult to bypass. The spread of tools such as deep packet inspection, national “kill switch” architectures, and satellite signal interference raises broader questions about the future of Internet freedom. What was once considered an exceptional measure is increasingly evolving into a transferable toolkit, shared among authoritarian governments seeking to manage disapproval.
Sources:
-
AP News – A timeline of how the protests in Iran unfolded and the crackdown that followed
https://apnews.com/article/iran-protests-us-israel-war-economy-d5da3b5f56449dd3871c9438c07f069f -
ARTICLE 19 – Islamic Republic of Iran: Computer Crimes Law (2012)
https://www.article19.org/data/files/medialibrary/2921/12-01-30-FINAL-iran-WEB%5B4%5D.pdf -
The Guardian – Iran’s digital shutdown: other regimes ‚will be watching closely‘ (2019)
https://www.theguardian.com/world/2019/nov/21/irans-digital-shutdown-other-regimes-will-be-watching-closely -
TechCrunch – Iran’s Internet shutdown is now one of its longest ever, as protests continue
https://techcrunch.com/2026/01/15/irans-Internet-shutdown-is-now-one-of-its-longest-ever-as-protests-continue/ -
Cloudflare Radar (X) – Network disruption data on Iran
https://x.com/CloudflareRadar/status/2009312093749801350 -
Financial Times – How Iran switched off the Internet
https://www.ft.com/content/5d848323-84a9-4512-abd2-dd09e0a786a3 -
BBC News – Fears Iran’s Internet shutdown could lead to ‚extreme digital isolation‘
https://www.bbc.com/news/articles/cg5gegrdq3go -
Euronews – At least 3,428 killed in Iranian security crackdown on protesters, rights group says
https://www.euronews.com/2026/01/14/at-least-3428-killed-in-iranian-security-crackdown-on-protesters-rights-group-says -
CBS News – Over 12,000 feared dead after Iran protests, as video shows bodies lined up at morgue
https://www.cbsnews.com/news/iran-protest-death-toll-over-12000-feared-higher-video-bodies-at-morgue/ -
BBC News – Starlink reportedly made free in Iran – but protesters are taking huge risks by using it
https://www.bbc.com/news/articles/c0r4veg0rrzo -
Forbes – ‘Kill Switch’—Iran Shuts Down Musk’s Starlink For First Time
https://www.forbes.com/sites/zakdoffman/2026/01/13/kill-switch-iran-shuts-down-starlink-Internet-for-first-time/ -
Medium – Jamming and Unjamming Starlink: High-Stakes Tech War in The Silent Sky
https://medium.com/the-low-end-disruptor/jamming-and-unjamming-starlink-high-stakes-tech-war-in-the-silent-sky-ff671e8cadfb -
Detector Media – MAXimum control: how Russia is implementing its digital isolation scenario
https://ms.detector.media/Internet/post/38380/2025-09-05-maximum-kontrolyu-yak-rosiya-realizuie-stsenariy-tsyfrovoi-izolyatsii/ -
Foreign Policy – How Russia Is Supporting Iran’s Repression
https://foreignpolicy.com/2026/01/14/iran-russia-moscow-khamenei-putin-protests/ -
Kyiv Independent – The Invisible War: Inside the electronic warfare arms race that could shape course of the war in Ukraine
https://kyivindependent.com/the-invisible-war-inside-the-electronic-warfare-arms-race-that-could-shape-course-of-the-war/
