When anti-government protests erupted across Iran in late December, some participants received an unsettling message. Authorities informed them by text that their “presence at illegal gatherings” had been recorded and that they were under intelligence surveillance. The warning was not idle. It signalled a more assertive use of Iran’s expanding digital infrastructure to identify and pursue dissenters.

Digital crackdown: In the weeks since the demonstrations were quelled, officials have gradually restored parts of the internet while deploying a technological dragnet to track those involved. Researchers and rights groups say the government has relied on mobile location data, facial-recognition systems and intercepted online activity to compile lists of suspected protesters. Some individuals have reportedly been detained and interrogated using evidence drawn from phone metadata and camera footage. Others have seen their SIM cards disabled, received threatening calls or faced disruptions to banking services.

Surveillance architecture: These measures rest on a digital architecture more than a decade in the making. Since around 2013 Iran has developed its National Information Network, enabling tighter control over web traffic and communications. Global platforms such as Instagram and WhatsApp are routinely blocked, nudging users toward domestic services that are easier to monitor. Registration requirements link SIM cards and devices to national identity records, facilitating movement tracking and data analysis. Additional tools—including spyware, traffic-monitoring systems and devices that capture phone identifiers—have broadened the state’s reach.

Foreign support: Iran has also drawn on foreign expertise. Researchers report technical cooperation with Russian firms and long-standing support from Chinese telecoms companies to bolster filtering and surveillance capabilities.

The system is not infallible; mistaken identifications have occurred. Nevertheless, Iran’s strategy illustrates how digital networks, once touted as instruments of openness, can be repurposed as mechanisms of control. As connectivity returns, scrutiny appears only to deepen.