Iran: Tightening the Net 2020 After Blood and Shutdowns. First published by ARTICLE 19, September 2020 ARTICLE 19 Free Word Centre 60 Farringdon Road London EC1R 3GA United Kingdom www.ARTICLE 19.org Text and analysis Copyright ARTICLE 19, September 2020 (Creative Commons License 3.0) Typesetting, Ana Z. ARTICLE 19 works for a world where all people everywhere can freely express themselves and actively engage in public life without fear of discrimination. We do this by working on two interlocking freedoms, which set the foundation for all our work. The Freedom to Speak concerns everyone’s right to express and disseminate opinions, ideas and information through any means, as well as to disagree from, and question power- holders. The Freedom to Know concerns the right to demand and receive information by power-holders for transparency good governance and sustainable development. When either of these freedoms comes under threat, by the failure of power-holders to adequately protect them, ARTICLE 19 speaks with one voice, through courts of law, through global and regional organisations, and through civil society wherever we are present. About Creative Commons License 3.0: This work is provided under the Creative Commons Attribution- Non-Commercial-ShareAlike 2.5 license. You are free to copy, distribute and display this work and to make derivative works, provided you: 1) give credit to ARTICLE 19; 2) do not use this work for commercial purposes; 3) distribute any works derived from this publication under a license identical to this one. To access the full legal text of this license, please visit: http://creativecommons.org/licenses/by-nc-sa/2.5/ legalcode CONTENTS Executive Summary 4 Acknowledgements 6 Glossary 7 Introduction 12 The big picture: Internet censorship in Iran 13 International Human Rights Standards on shutdowns 14 Chapter 1: The anatomy of the shutdown 15 Impact of the shutdown 17 A timeline 18 Chapter 2: The National Information Network and shutdowns 21 What is the NIN? 23 Users driven to local services 24 The role of US sanctions 25 Proposed bill could further nationalise infrastructure and data 27 Lack of transparency around shutdowns and the NIN 28 Chapter 3: Iran’s Internet Infrastructure 30 ISPs, gateways, and shutdowns 31 The structure of connection in Iran 32 Two entities controlling international gateways: TIC and IPM 32 Decentralising access: changes since November 2019 34 Why decentralise? 34 ISPs enact government censorship 37 Chapter 4: Iran’s Internet decisions 38 Ordering a shutdown 39 Power Structures Involved In Iran’s Internet Decisions 40 Internet Policy: where does the power lie? 42 Changing the rules for ordering an Internet Shutdown? 44 Recommendations 45 Endnotes 54 1 EXECUTIVE SUMMARY In November 2019, protests broke out across Iran over a fuel price hike; authorities responded with violence and repression. They also disconnected millions of Iranians from the Internet. Iran’s November shutdowns were unprecedented in length and reach. On a vast scale, they cut people off from vital information and from each other. Authorities subjected protesters to violent assaults without the exposure that access to the Internet enables. The ability to conduct these shutdowns is the culmination of many policies, technological developments, and systems of centralised control that permeate Iran’s system, and especially its Internet governance. This report takes a close look at the Internet shutdowns that accompanied the protest period from 15 November to 27 November, as well as the mechanisms, infrastructure, law, and policies that enabled this kind of disconnection. It then looks at the aftermath of the protests and the outlook for Internet governance and connectivity in Iran. INTRODUCTION Here we provide the context to the November 2019 unrest and crackdown, as well as discussing the other forms of censorship used by the Iranian authorities to control the flow of information within Iran’s borders. We also lay out international human rights standards on Internet shutdowns. CHAPTER 1: THE ANATOMY OF THE SHUTDOWN This chapter explains in detail the timeline of the shutdown, from the announcement of the price hikes that sparked nationwide protest to the reconnection later on. It also discusses the immediate effects of the shutdown and the consequences for protest and information during that time. CHAPTER 2: THE NATIONAL INFORMATION NETWORK Chapter 2 examines one of the key elements which enabled November’s unprecedented shutdowns: the National Information Network (NIN). Shutdowns generally result in severe financial losses, due to unavailable services and loss of communication with global partners and supply chains. Iran, however, has spent recent years building a NIN (a type of national Internet), which hosts a number of key services and government functions. While access to the global Internet was cut off, domestic Internet services (hosted on the NIN), such as national banking, local applications, government websites and services, remained online. This minimised losses and kept the government functioning nearly as normal throughout the shutdown. 4 The chapter documents the development of the NIN and its role in Internet shutdowns, including the significance of US sanctions on its development and the digital rights of Iranian citizens. It also looks at new bills that propose to entrench the NIN and pose various concerns for digital rights. CHAPTER 3: IRAN’S INTERNET INFRASTRUCTURE Iran’s authorities have large-scale control over about 57.4 million Internet users in a total population of about 82 million. This requires a tight grip on both the national infrastructure and its Internet actors. The chapter explains how the shutdown was carried out. Under orders of the National Security Council (NSC), the shutdown was carried out by Internet Service Providers (ISPs) and, during the protests, access to international gateways was entirely under government control. This chapter also highlights that the connections infrastructure underpins the authorities’ high level of control. It looks at the control of international gateways, and documents changes in the infrastructure, including the decentralisation of access to gateways. ISPs remain under strict control of the government. CHAPTER 4: IRAN’S INTERNET DECISIONS The shutdown was distributed to ISPs by the Communications Regulatory Authority, under the Ministry of Information and Communication Technology (ICT), ordered by the NSC. This information alone, however, does not begin to tell us who and which factions of Iranian governance were behind November’s events. This chapter attempts to explore further the accountability, or lack thereof, for the crackdown on both digital and protest rights. Ambiguity about the processes of Internet decisions is a hallmark of the overall governance system in Iran. Although some members of President Rouhani’s administration have apologised for the shutdowns, others, like Rouhani’s Minister of Interior, have vehemently defended them. The government has not transparently documented what roles they played. This chapter maps where power lies, and analyses recently proposed reforms to decision-making processes. RECOMMENDATIONS We end this report by making a series of recommendations to the Iranian authorities and international bodies to ensure the right to access the Internet and, in turn, freedom of expression in Iran. 5 2 ACKNOWLEDGEMENTS ARTICLE 19 appreciates research inputs by Project Ainita to this report and contributions by researchers who wish to remain anonymous. The ARTICLE 19 Middle East and North Africa (MENA) programme focuses on a number of countries in the region with concerns over their records on freedom of expression in the world. Many countries in the region lack legal protections for human rights and the rule of law is undermined by a lack of independent judiciaries. The 2011 Arab Spring popular protests brought hope for improvements, but devastating wars, foreign intervention, and instability have since made it an extremely dangerous environment for journalists, civil society, and human rights defenders, forcing millions to leave in search of safety. As war and conflict tear apart infrastructure and cause huge regression in development indicators across Yemen, Syria, Libya, and Iraq, elsewhere repressive governments in Saudi Arabia, Iran, Egypt, and Bahrain have reinforced anti-human rights practices, often in the name of national security and counterterrorism. ARTICLE 19’s work on Iran focuses on monitoring laws, policies, and regulations that affect freedom of expression and information online and offline. We monitor Iran’s complex Internet policies and respond to evolving threats online. If you would like to discuss this report further, please contact Mahsa Alimardani at mahsa@ARTICLE 19.org 6 3 GLOSSARY English Acronym Explanation Autonomous System AS The Internet is a network of networks broken up into hundreds of thousands of smaller networks known as autonomous systems (AS). Each of these networks is essentially a large pool of routers run by a single organisation. If we continue to think of Border Gateway Protocol (BGP) as the postal service of the Internet, ASs are like individual post office branches. A town may have hundreds of mailboxes, but the mail in those boxes must go through the local postal branch before being sent to another destination. The internal routers within an AS are like mailboxes: they forward their outbound transmissions to the AS, which then uses BGP routing to send these transmissions