Internet Censorship in Iran: Findings from 2014-2017

by agrabeli | September 28, 2017

 

This post is part of a series that highlights OONI reports which examine internet censorship in various countries around the world.

Today, in collaboration with ASL19, ARTICLE 19 and Small Media, the Tor Project’s Open Observatory of Network Interference (OONI) team published a research report on internet censorship in Iran.

This study reveals and confirms censorship events through the analysis of thousands of network measurements collected from 60 networks across Iran over the last three years. OONI’s network measurement data clearly shows evidence of information controls across Iranian ISPs. 

This post provides an overview of key findings. Read the full report here.

Pervasive internet censorship

We confirm the blocking of 886 domains (and 1,019 URLs in total) in Iran over the last three years, most of which include news outlets and human rights sites. A wide range of different types of sites were blocked, with blocking extending beyond a simple definition of legality. Both the breadth and scale of internet censorship in Iran is remarkable.

Graph of blocked domains in Iran, 2014-2017

Notable blocked domains include:

The full list of observed blocked domains is available here.

Internet censorship in Iran is quite sophisticated. ISPs were found to serve block pages through DNS injection and through the use of HTTP transparent proxies. Most ISPs not only blocked the same sites, but they also used a standardized set of censorship techniques, suggesting a centralized censorship apparatus.

We find that Iran regularly blocks both encrypted (HTTPS) and unencrypted (HTTP) access to sites, making censorship circumvention harder. In the past, when sites like Instagram did not support HTTPS, it was reported that Iranian ISPs would selectively censor content, rather than block access to entire domains. Today, we primarily see blocking of domains, including HTTPS access, since it’s not possible for the censor to tailor censorship to specific content of encrypted sites. This indicates that Iranian ISPs may have shifted their practices from applying “smart filters” (only censoring specific web pages) to “blanket censorship” (censoring entire services).

Censorship in Iran is not limited to websites. Facebook Messenger was blocked through DNS tampering. Other popular communications apps, like WhatsApp and Telegram, remained accessible during the testing period. 

Internet censorship in Iran is reinforced through the extensive blocking of multiple censorship circumvention tools. OONI tests revealed blocking of the Tor network in many networks across Iran. Some Tor bridges, which are offered to help circumvent censorship, remained partially accessible. 

Iranian ISPs also appear to be taking extra steps to limit censorship circumvention. We found online translators, such as SYSTRAN and Babylon Translation, to be blocked. Pasting a URL into an online translator will provide access to the site’s content, even if that site is blocked. Online translators can therefore provide a form of censorship circumvention, possibly explaining why we found them to be blocked.

Non-deterministic internet censorship

Iranian ISPs do not appear to block sites consistently over time. Rather, they were found to flip between blocking and unblocking sites, possibly in an attempt to create uncertainty on whether a site is actually censored or to make the censorship more subtle.

The example below shows how an ISP blocked and unblocked access to google.com.

probe_asn domain calc_blockpage count
AS31549 google.com not-blocked 15
AS31549 google.com not-blocked 18
AS31549 google.com not-blocked 19
AS31549 google.com ir-iframe-1 18
AS31549 google.com not-blocked 18
AS31549 google.com not-blocked 17
AS31549 google.com ir-iframe-1 19
AS31549 google.com not-blocked 16
AS31549 google.com not-blocked 18
AS31549 google.com ir-iframe-1 19
AS31549 google.com not-blocked 17
AS31549 google.com not-blocked 19
AS31549 google.com not-blocked 18
AS31549 google.com not-blocked 17
AS31549 google.com not-blocked 18
AS31549 google.com not-blocked 18
AS31549 google.com not-blocked 18
AS31549 google.com ir-iframe-1 19
AS31549 google.com not-blocked 18
AS31549 google.com not-blocked 17
AS31549 google.com ir-iframe-1 18

 

We also found ISPs to be blocking the same sites with different techniques.

probe_asn domain calc_blockpage count
AS31549 bbc.com dns-blk-0 2
AS31549 bbc.com ir-iframe-1 1
AS31549 bbc.com dns-blk-0 2
AS31549 bbc.com ir-iframe-1 16
AS31549 bbc.com ir-iframe-1 15
AS31549 bbc.com not-blocked 1

 

Most ISPs in Iran implemented non-deterministic internet censorship during the testing period. A database of these observations is available here. 

National and international politics are influential

Political relations appear to influence how information controls are implemented in Iran.

Multiple Israeli domains were found to be blocked. These include government sites, news outlets (haaretz.com), sports sites (basket.co.il), and a mail provider (mail.walla.co.il) among others. Blocking of Israeli domains is not limited to those expressing criticism towards the Iranian government or which host illegal content, suggesting that Iranian ISPs likely block Israeli domains indiscriminately, regardless of their content. The breadth of Israeli domain blocking also indicates that politics influence how information controls are implemented in Iran. The blocking of usaid.gov and cia.gov likewise suggests that political tensions between Iran and the U.S. have led to internet censorship actions in the country.

U.S. export laws and regulations, on the other hand, restrict the use of services in Iran. Norton (a popular antivirus program) and GraphicRiver (a site for graphic designers and illustrators) were inaccessible because they block access from Iran. Virus Total, a site that enables its users to upload and scan files and URLs for malware, was also inaccessible. Virus Total uses Google App Engine (GAE), a web framework and cloud computing platform, commonly used for hosting sites and for domain fronting (a technique for censorship circumvention). We found that IP addresses originating from Iran were blocked by Google from accessing these services. This has been known since (at least) 2010 and, like Norton and GraphicRiver, Google blocks access to GAE from Iran in compliance with U.S. export laws.

Internet censorship in Iran also appears to serve as a tool for the reinforcement of geopolitical power dynamics. Over the last century, there has been an ongoing separatist dispute between the Kurdish opposition in western Iran and the Iranian government. According to Amnesty International, many Kurdish human rights defenders, community activists and journalists have faced arbitrary arrests and prosecution. The blocking of numerous Kurdish sites, including news outlets and human rights sites, appear to be politically motivated.

Reproduce our research

This study is part of an ongoing effort to monitor internet censorship in Iran and around the world. Since this research was carried out through the use of free and open source software, open methodologies and open data, it can be reproduced.

Anyone can run ooniprobe on Android, iOS, macOS, Linux, and on Raspberry Pis. Tens of thousands of ooniprobe users from more than 200 countries have already done so. Thanks to their testing, millions of networks measurements have been published, shedding light on information controls worldwide.

But censorship findings are only as interesting as the types of sites and services that are tested. We therefore encourage you to contribute to the review and creation of test lists, to help advance future research in Iran and beyond.

To learn more about this study, read the full report here.   

Comments

Please note that the comment area below has been archived.

We found access to the Tor network to be blocked in many networks in Iran. Here's an example: https://explorer.ooni.torproject.org/measurement/20170808T004237Z_AS197…

However, censorship in Iran is non-deterministic, meaning that we found ISPs to block and unblock Tor (and other tools and sites) over time.

Tor bridges were accessible most of the time, potentially enabling Iranians to circumvent the censorship and connect to the Tor network.

Anonymous (not verified) said:

September 28, 2017

Permalink

Documenting censorship by non-FVEY governments is one of the most important things we can do to convince US lawmakers not to simply outlaw Tor use in the USA, or to declare Tor Project a "terrorist organization" [sic], as so many other countries have rushed to do.

That said, I'd like to see an OONI report on Australia and other FVEY nations.

Also an up to date report on censorship in more Latin American countries, especially MX and BR.

We're currently prioritizing on writing OONI reports on countries where (a) we know there's censorship / have come across censorship in OONI data, (b) we have local partnerships. We're collaborating with groups in Latin America, so you should expect to see OONI reports on the region within the next year. :)

We're happy to write reports on Australia and other FVEY nations as well in the future (particularly when/if we come across censorship events).

For now, we encourage you to explore the publicly open data for Australia (and many other countries around the world): https://explorer.ooni.torproject.org/world/

You can also download json files here: https://measurements.ooni.torproject.org/

India (not verified) said:

September 28, 2017

Permalink

Government of India also have banned internet archives to block users from accessing the truth and spread their fake news and manipulative agenda.

ooni_x (not verified) said:

September 28, 2017

Permalink

like you wrote the censorship can be subtle/biased/deviant : fake, trap, mitm, slow, open few hours/week, unsearchable, redirection, with a perfect appearance of democracy/open-mind etc.
* that can be applied in most countries.

This study reveals and confirms censorship events through the analysis of thousands of network measurements collected from 60 networks across **** over the last three years. OONI’s network measurement data clearly shows evidence of information controls across **** ISPs.
* that can be applied in most countries.

blocking pornography (62) is a good sign_pornography kills the dignity.
* that should be applied in most countries.

Multiple **** domains were found to be blocked.
* i think that weapon trade & hacking from secret service are the reason why it is not opened for anyone.
* that can be applied in most countries.

The blocking of usaid.gov and cia.gov likewise suggests that political tensions between Iran and the U.S. have led to internet censorship actions in the country.
* i think it should not be blocked if there should have clients for these sites.

According to ****, many **** human rights defenders, community activists and journalists have faced arbitrary arrests and prosecution. The blocking of numerous **** sites, including news outlets and human rights sites, appear to be politically motivated.
* that can be applied in most countries.

your article is clear, neat, well explained : a pleasure.
i would like run ooni but it is not an anonymous tool.

Someone (not verified) said:

October 02, 2017

Permalink

This can no longer be called "Internet"
It is a highly controlled set of connections sometimes connected to rest of the world.

Iran's government even looks at game traffic as suspicious data transfer...

Anymouse (not verified) said:

October 16, 2017

Permalink

Thanks for sharing. New to the TorProject and decided to use because I've personally seen in increase in censorship in the US. Keep up the good work.

cynical (not verified) said:

October 17, 2017

Permalink

Perhaps the censorship in Iran is inconsistent for the purpose of luring more unwitting internet users into attempting to connect to, say, the BBC some number of multiple times until the user gives up -- as a way for the Govt. of Iran to measure the amount of interest in a censored site that some particular Iranian citizen may have.