Iran's 18-day internet blackout isolates millions as government controls information flow

Iran's internet blackout has now entered its 18th day, according to monitoring group NetBlocks, with the vast majority of the country experiencing over 400 consecutive hours without internet connectivity. The Iranian government imposed these restrictions hours after the first US-Israel missile strikes on February 28, effectively cutting off millions of citizens from the global internet at a moment when access to communications and reliable information is most critical.

Before the strikes, NetBlocks reported close to 100 percent internet uptime across Iran. In the aftermath, connectivity fell to just above 0 percent, with only "chosen users" granted privileged access. Alp Toker, director at NetBlocks, told The Register that while some users can theoretically gain web access, this is only through channels not under state control—channels that are few and highly expensive, making them unavailable to the average person.

"Those who can pay have been more able to get online because they can buy contraband services that are risky to provide," Toker explained. "That can be a VPN which distributes internet connectivity from a Starlink terminal, or a user at the border with another country running a bridge network between the two, which are both banned and not great to be caught operating."

However, most of those who have retained access aren't contraband users or wealthy individuals, but rather communications experts and state-aligned media who have been selected to deliver on-message framing to the outside world. This includes visiting foreign journalists who are there by permission and unlikely to deviate from permitted narratives.

Iran has a history of revoking internet access during times of crisis, using blackouts both to prevent information from leaving the country and to stop people from learning more about situations than what the state is willing to share. Toker noted that "the risk of metadata and geolocation leaks will definitely have been a factor," adding that while other countries in the region struggle with similar challenges, the selective mechanisms in Iran point to the blackout being used foremost as a mechanism to shape narratives abroad and keep dissent in check at home.

This latest blackout follows a similar pattern to January's lengthy internet and mobile connectivity blackout, which occurred following civil unrest related to the collapse of Iran's official currency, the rial. The rial's value had roughly halved over six months, with inflation rising to over 40 percent. Digital rights organization Access Now observed at the time that "what began as protests over currency inflation quickly evolved into an outcry against decades of repression, corruption, and systemic injustice, echoing previous waves of nationwide unrest."

With traditional VPNs inaccessible due to the lack of internet via telecom operators, civilians inside Iran are struggling to communicate. Mahsa Alimardani, associate director at Witness, told AFP that while phone lines remain operational, people fear discussing political matters due to surveillance concerns.

Organizations like Amsterdam-based Radio Zamaneh have stepped in to send broadcasts to Iran over shortwave radio, which is difficult for the state to jam. However, access to outside information beyond these channels remains rare for most Iranians.

Despite the blackout, Iran's offensive cyber groups continue operating from external infrastructure with pre-positioned access. Security experts report that groups like Seedworm, Homeland Justice, and Handala—all with suspected ties to the Iranian state and its intelligence service—remain active. Handala, in particular, has drawn attention following its wiper attack on Stryker, which the medical device company said affected its Microsoft corporate environment.

Nathaniel Jones, vice president of security and AI strategy at Darktrace, expects a continuation of Iran's destructive cyberattacks over the coming days, particularly against critical infrastructure organizations, followed in a few weeks by more sophisticated supply chain attacks.

The human cost of this information blackout is severe. According to digital rights groups, the reported death toll in Iran has surpassed 1,000 people, with military escalations continuing to affect civilians across the Middle East, including the Gulf States and Lebanon, where ongoing Israeli attacks have reportedly killed over 500 people and displaced more than 500,000.

Security firm Akamai recently reported a 245 percent increase in cybercrime activity since the US and Israel began military operations against Iran, though much of this stemmed from Russia and China rather than Iran itself. The combination of military conflict, cyber operations, and information control creates a complex and dangerous environment for Iranian civilians caught between state repression and international conflict.