The Iranian regime disconnected 90 million people from the grid, and got the opposite result

According to reports in the international media, including the “Wall Street Journal”, the authorities have even begun to locate and confiscate equipment from Elon Musk’s Starlink satellite internet venture, mainly in western Tehran. This, while the regime itself, the security agencies and its loyalists have free access to a limited list of approved websites and web addresses. Meanwhile, the regime urges residents to rely on the Mehr news agency, which is affiliated with the security forces.

But the blackout actually reveals the opposite truth: in Iran, even when the network is shut down, the information continues to flow.

Not the first “blackout”.

The goal of the regime is clear: to cut off the oxygen pipe of the protest. The Iranians want to reveal on the networks the scope of the demonstrations, the violence of the security forces and the human cost they are exacting – and the regime is working to prevent the images and videos from going out into the world. Accordingly, the most severe internet disruptions were recorded in the Tehran neighborhoods where the protests are taking place.

Still, documents continue to leak: the Vahid Online Telegram channel publishes photos of corpses on the outskirts of the capital and even shared a video from the funeral where the cries of “Death to Khamenei” were heard.

This is not the first time that the Iranian regime cuts off the public from the Internet during protests. In November 2019, following the increase in fuel prices, the country was cut off from the grid for more than five days. Even in September 2022, after the death of Mahsa Amini and the outbreak of a wide wave of protests, Internet services were significantly damaged.

According to NetBlocks data, until January 8 Internet traffic in Iran was close to 100%, but since then more than 140 hours of almost complete disconnection have been recorded. These data are also backed up by Cloudflare’s reports, according to which after the collapse in traffic the internal traffic volume from Iran was measured to be less than 0.01%.

Despite this, Iranians continue to find ways to connect to the network. One of the main ones is the use of Starlink terminals, which are already in the country. Guy Amir, CEO of Visionheight, a cyber company that specializes in predicting threats, tells Globes that “there are many Starlink terminals in Iran, and not from today.”

Possession of the Starlink terminals is illegal in Iran, so they were smuggled into the country – sometimes by small boats or through border crossings. “People who arrive on yachts have Starlink legally, and if they have a global package, they can connect from anywhere in the world. At the same time, terminals were smuggled into Iran. When they tried to filter Starlink traffic, they discovered that it was almost impossible to do so when the source was satellite. This is how underground Wi-Fi networks are created, and according to estimates, most of the traffic that leaves Iran today is based on Starlink,” he explains.

Along with this, there are two other ways to connect to the network: “The first is to use a proxy and a VPN to bypass the regime’s filters. Completely blocking the Internet is a complex task, and in practice, access to the outside is mostly blocked, while the internal network is still working,” explains Amir. “In addition, there is a very large underground market for VPN services in Iran, mainly through Telegram. The second option is to connect through the borders. SIM cards can be purchased in Iraq or Afghanistan. The information is transferred to the border areas, and from there they connect to the network and send everything out in encrypted form.”

“This is electronic warfare”

In the background, reports surfaced according to which the US is considering the possibility of moving more Starlink terminals to Iran. According to the publications, President Donald Trump even spoke with Musk in an attempt to examine possible steps.

Amir Rashidi, director of digital rights and security at the Mayan organization that deals with the protection of human rights, told the Wall Street Journal that “this is electronic warfare.” A resident of Tehran told the newspaper that he used the Starlink connection to transmit protest videos taken by his family members to parties outside the country for publication on the networks. In an interview with The Guardian, Rashidi added that citizens also use distributed messaging services such as Delta Chat and the Ceno browser.

According to estimates, more than 50,000 Starlink terminals are currently operating in Iran. A law approved in Iran in 2025 states that the possession of such a terminal could be interpreted as espionage for Israel – an offense punishable by up to ten years in prison.

The regime, for its part, is trying to fight the phenomenon. The tools used by Iran to disrupt the terminals are similar to military means used to disrupt drones in the Ukrainian battlefield, Rashidi told The Guardian.

Take over the conversation

Tom Divon, a researcher of social networks from the Department of Communication at the Hebrew University, explains to Globes that “Internet blocking and disconnections are a common tool in such regimes, the purpose of which is to control the narrative and block the flow of information. We have seen this in Egypt, Tunisia, the Arab Spring and Hong Kong. Controlling the Internet is controlling the public discourse.”

According to him, in addition to complete disconnections, proactive slowdowns of the network are also activated, which prevent videos from being uploaded due to extremely low speed. “It is used like a weapon – similar to an olive mace in a protest – with the aim of dispersing and exhausting the demonstrators.”

However, Divon emphasizes that the opposite effect is often obtained. “The means of intimidation actually push the citizens to look for ways to connect. A culture of digital resistance is being created: use of VPNs, proxies and encrypted channels. Unlike the Arab Spring, today there is a deeper understanding of encrypted tools and their role in sending messages out.”

The result, according to him, is flooding precisely at the time of darkness. “Not only does the content not disappear – it multiplies. The same content unit appears again and again on different channels. Citizens work against messengers outside the country, and they become amplifiers of the message. The regime is shooting itself in the foot, because there is an overflow of content, and every piece of information that comes out gets more screen time.”

A striking example of this is the “smoking girls” trend that spread on the networks, even if it is not clear if it originated in Iran. These are videos of girls removing the hijab, smoking a cigarette and using it to burn a picture of the supreme leader.

As for the active platforms, Divon specifically points to Tiktok. “Its distribution mechanism is different from that of meta platforms. The content comes through the For You feed and not on the basis of friends or followers, which enables wide exposure even for small accounts. In addition, the culture of remixes (the possibility to join a trend and respond to it, NT) and the quick responses make Tiktok a particularly responsive network. Therefore, when an event happens in Iran, the first place to look is Tiktok, not Google.”