Iran's 'chosen users' get 'privileged access' despite internet blackout for masses
(2026/03/17)
- Reference: 1773749949
- News link: https://www.theregister.co.uk/2026/03/17/iran_internet_blackout/
- Source link:
Iran's internet blackout is entering day 18, according to monitoring outfit NetBlocks, which says the vast majority of the country has been offline for more than 400 consecutive hours.
The Iranian government imposed domestic internet restrictions hours after the first US-Israel missile strikes against the country on February 28.
NetBlocks [1]reported close to 100 percent internet uptime in the days preceding the strikes, but said it fell to just above 0 percent thereafter.
[2]
It said that "chosen users are granted privileged access," but the vast majority are left without any internet connectivity.
[3]
[4]
Alp Toker, director at NetBlocks, told The Register that some users can, in theory, gain access to the web, but only through channels not under state control, which are few and highly expensive. They are not available to the average person.
"Those who can pay have been more able to get online because they can buy contraband services that are risky to provide," he said. "That can be a VPN which distributes internet connectivity from a Starlink terminal, or a user at the border with another country running a bridge network between the two, which are both banned and not great to be caught operating.
[5]
"But most of those who have retained access aren't the contraband users, or even the rich and famous, but rather the communications experts and state-aligned media who have been selected to deliver on-message framing to the outside world. That also includes visiting foreign journalists who are there by permission and unlikely to deviate too far from permitted narratives."
Iran has a history of revoking internet access to citizens in times of crisis. It does so to both prevent information from leaving the country and to stop people from learning more about the situation than what the state is willing to share.
Toker added: "The risk of metadata and geolocation leaks will definitely have been a factor, and other countries in the region are struggling with the same challenge of geo leaks, but the selective mechanisms we're seeing in Iran point to the blackout foremost as a mechanism to shape narratives abroad and keep dissent in check at home."
[6]
Weeks before the US-Israel strikes, Iran implemented a lengthy internet and mobile connectivity blackout [7]in January following civil unrest that broke out a month earlier, related to the collapse of the country's official currency, the rial.
The rial's value had roughly halved over the preceding six months, but its decline had been observed for years, owing to a range of factors, mainly inflation, which had risen to over 40 percent.
"What began as protests over currency inflation quickly evolved into an outcry against decades of repression, corruption, and systemic injustice, echoing previous waves of nationwide unrest," said digital rights organization Access Now at the time.
Most of those who have retained access aren't the contraband users, or even the rich and famous, but rather the communications experts and state-aligned media who have been selected to deliver on-message framing to the outside world
Of the latest blackout, the group [8]stated : "Millions of people in Iran have been cut off from the global internet at a moment when access to communications and reliable information is most critical.
[9]Cybercrime has skyrocketed 245% since the start of the Iran war
[10]Pentagon AI chief praises Palantir tech for speeding battlefield strikes
[11]White House activates Yu-Gi-Oh's trap card by using anime clip for war comms
[12]Iran plots 'infrastructure warfare' against US tech giants
"The reported death toll in Iran has surpassed 1,000 people, and the military escalations continue to affect civilians across the Middle East, including the Gulf States and in Lebanon, where the ongoing Israeli attacks have reportedly killed over 500 people and displaced more than 500,000."
Civilians inside the country are not able to communicate via traditional VPNs since there is no access to the internet via telecoms operators, and Mahsa Alimardani, associate director at Witness, told [13]AFP that while phone lines are operational, no one dares to discuss political matters due to surveillance fears.
Organizations like Amsterdam-based Radio Zamaneh are sending broadcasts to Iran over shortwave radio, which is difficult for the state to jam, but access to outside information beyond channels like these is rare.
Iran's cyber attackers are still online
Nathaniel Jones, vice president of security and AI strategy and field CISO at Darktrace, said that the blackout does not appear to be affecting Iran's offensive cyber groups.
"Seedworm, Homeland Justice, and Handala continue operating from external infrastructure with pre‑positioned access."
All three groups have suspected ties to the Iranian state and its intelligence service (MOIS), although Handala has arguably been the most talked about following its wiper attack on Stryker, which the medical device company [14]said affected its Microsoft corporate environment.
Jones said he expects a continuation of Iran's [15]destructive cyberattacks over the coming days, particularly against critical infrastructure organizations, followed in a few weeks by more sophisticated attacks on supply chains.
Security shop Akamai recently reported a [16]245 percent increase in cybercrime activity since the US and Israel started the war on Iran, although much of this stemmed from Russia and China rather than Iran itself. ®
Get our [17]Tech Resources
[1] https://x.com/netblocks/status/2033808397447954492
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2026/01/09/iran_russia_ukraine_internet_outages/
[8] https://www.accessnow.org/press-release/iran-connect-the-population-statement/
[9] https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/
[10] https://www.theregister.com/2026/03/13/palantirs_maven_smart_system_iran/
[11] https://www.theregister.com/2026/03/12/yugioh_us_propaganda/
[12] https://www.theregister.com/2026/03/11/iran_threatens_us_tech_companies/
[13] https://www.france24.com/en/live-news/20260313-how-iranians-are-communicating-through-internet-blackout
[14] https://www.stryker.com/gb/en/about/news/a-message-to-our-customers-03-2026.html
[15] https://www.theregister.com/2026/03/11/iran_threatens_us_tech_companies/
[16] https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/
[17] https://whitepapers.theregister.com/
The Iranian government imposed domestic internet restrictions hours after the first US-Israel missile strikes against the country on February 28.
NetBlocks [1]reported close to 100 percent internet uptime in the days preceding the strikes, but said it fell to just above 0 percent thereafter.
[2]
It said that "chosen users are granted privileged access," but the vast majority are left without any internet connectivity.
[3]
[4]
Alp Toker, director at NetBlocks, told The Register that some users can, in theory, gain access to the web, but only through channels not under state control, which are few and highly expensive. They are not available to the average person.
"Those who can pay have been more able to get online because they can buy contraband services that are risky to provide," he said. "That can be a VPN which distributes internet connectivity from a Starlink terminal, or a user at the border with another country running a bridge network between the two, which are both banned and not great to be caught operating.
[5]
"But most of those who have retained access aren't the contraband users, or even the rich and famous, but rather the communications experts and state-aligned media who have been selected to deliver on-message framing to the outside world. That also includes visiting foreign journalists who are there by permission and unlikely to deviate too far from permitted narratives."
Iran has a history of revoking internet access to citizens in times of crisis. It does so to both prevent information from leaving the country and to stop people from learning more about the situation than what the state is willing to share.
Toker added: "The risk of metadata and geolocation leaks will definitely have been a factor, and other countries in the region are struggling with the same challenge of geo leaks, but the selective mechanisms we're seeing in Iran point to the blackout foremost as a mechanism to shape narratives abroad and keep dissent in check at home."
[6]
Weeks before the US-Israel strikes, Iran implemented a lengthy internet and mobile connectivity blackout [7]in January following civil unrest that broke out a month earlier, related to the collapse of the country's official currency, the rial.
The rial's value had roughly halved over the preceding six months, but its decline had been observed for years, owing to a range of factors, mainly inflation, which had risen to over 40 percent.
"What began as protests over currency inflation quickly evolved into an outcry against decades of repression, corruption, and systemic injustice, echoing previous waves of nationwide unrest," said digital rights organization Access Now at the time.
Most of those who have retained access aren't the contraband users, or even the rich and famous, but rather the communications experts and state-aligned media who have been selected to deliver on-message framing to the outside world
Of the latest blackout, the group [8]stated : "Millions of people in Iran have been cut off from the global internet at a moment when access to communications and reliable information is most critical.
[9]Cybercrime has skyrocketed 245% since the start of the Iran war
[10]Pentagon AI chief praises Palantir tech for speeding battlefield strikes
[11]White House activates Yu-Gi-Oh's trap card by using anime clip for war comms
[12]Iran plots 'infrastructure warfare' against US tech giants
"The reported death toll in Iran has surpassed 1,000 people, and the military escalations continue to affect civilians across the Middle East, including the Gulf States and in Lebanon, where the ongoing Israeli attacks have reportedly killed over 500 people and displaced more than 500,000."
Civilians inside the country are not able to communicate via traditional VPNs since there is no access to the internet via telecoms operators, and Mahsa Alimardani, associate director at Witness, told [13]AFP that while phone lines are operational, no one dares to discuss political matters due to surveillance fears.
Organizations like Amsterdam-based Radio Zamaneh are sending broadcasts to Iran over shortwave radio, which is difficult for the state to jam, but access to outside information beyond channels like these is rare.
Iran's cyber attackers are still online
Nathaniel Jones, vice president of security and AI strategy and field CISO at Darktrace, said that the blackout does not appear to be affecting Iran's offensive cyber groups.
"Seedworm, Homeland Justice, and Handala continue operating from external infrastructure with pre‑positioned access."
All three groups have suspected ties to the Iranian state and its intelligence service (MOIS), although Handala has arguably been the most talked about following its wiper attack on Stryker, which the medical device company [14]said affected its Microsoft corporate environment.
Jones said he expects a continuation of Iran's [15]destructive cyberattacks over the coming days, particularly against critical infrastructure organizations, followed in a few weeks by more sophisticated attacks on supply chains.
Security shop Akamai recently reported a [16]245 percent increase in cybercrime activity since the US and Israel started the war on Iran, although much of this stemmed from Russia and China rather than Iran itself. ®
Get our [17]Tech Resources
[1] https://x.com/netblocks/status/2033808397447954492
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33abmIs5TKKV2qP52a8gwnLgAAAkI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2026/01/09/iran_russia_ukraine_internet_outages/
[8] https://www.accessnow.org/press-release/iran-connect-the-population-statement/
[9] https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/
[10] https://www.theregister.com/2026/03/13/palantirs_maven_smart_system_iran/
[11] https://www.theregister.com/2026/03/12/yugioh_us_propaganda/
[12] https://www.theregister.com/2026/03/11/iran_threatens_us_tech_companies/
[13] https://www.france24.com/en/live-news/20260313-how-iranians-are-communicating-through-internet-blackout
[14] https://www.stryker.com/gb/en/about/news/a-message-to-our-customers-03-2026.html
[15] https://www.theregister.com/2026/03/11/iran_threatens_us_tech_companies/
[16] https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/
[17] https://whitepapers.theregister.com/
Re: "Civilians relying on Dutch shortwave radio broadcast for outside information"
Martin an gof
I know they are switching emphasis, but according to [1]this page they still operate on SW quite widely, including in the Middle East.
M.
[1] https://www.bbc.co.uk/programmes/articles/2x9tqt6mc05vB2S37j8MWMJ/global-short-wave-frequencies
Re: "Civilians relying on Dutch shortwave radio broadcast for outside information"
Dan 55
The Arabic radio service was closed down on the 27th of January 2023 according to [1]this . It's now online only.
[1] https://en.wikipedia.org/wiki/BBC_World_Service#Current_services
Re: "Civilians relying on Dutch shortwave radio broadcast for outside information"
heyrick
" It's now online only. "
As if a regime in trouble hasn't ever pulled the plug on the internet before... This is some real joined up thinking from the BBC.
Re: "Civilians relying on Dutch shortwave radio broadcast for outside information"
Spazturtle
Good thing the Iranians speak Persian and BBC World Service still transmits radio in Persian.
Re: "Civilians relying on Dutch shortwave radio broadcast for outside information"
C R Mudgeon
The USA had one too, Voice of America. Gee, Donald, I wonder if such a service might be useful, right about now.
Re: Voice of America.
Anonymous Coward
Illegally run by Kari Lake and now having to back out all her unlawful changes.
Re: "Civilians relying on Dutch shortwave radio broadcast for outside information"
STOP_FORTH
Famously, the BBC World Service of old would reduce the hours of, or completely suspend, language broadcasts to parts of the world that were about to experience upheavals/invasions etc.
This was done at the request of their paymasters of the time the FCO. (Or maybe they were just the FO back then?)
The two examples that spring to mind are the South American service just before the Argentinian invasion of The Falklands and the Afghan (and possibly other?) service before the Russians had their turn at being humiliated.
Those Foreign Office types really know their stuff!
"Civilians relying on Dutch shortwave radio broadcast for outside information"
The BBC had a world service for that kind of thing. [1]Not any more though .
[1] https://www.theregister.com/2026/03/17/bbc_world_service_digital_pivot/