*This article is originally published in the Asia Pacific Policy Observatory May 2024 Report.
The recent legislative elections in Iran, held on March 1, 2024, concluded with results that largely met expectations. A key policy area anticipated to dominate the agenda of the newly elected legislative assembly is the governance of digital space.
Iran’s approach to digital policy has been marked by rigorous regulations. In this vein, both the executive and legislative branches have undertaken substantial measures to exert control over the digital landscape, paying particular attention to social networks that had previously been overlooked by the nation’s authorities. A key initiative in this regulatory endeavor, the Protection Bill, has been criticized by rights groups for infringing upon various human rights in Iran, notably the rights to freedom of expression and privacy. However, it seems that the newly elected parliament, despite its expected focus on digital policies, will face considerable obstacles, especially in engaging with the younger demographic.
This study assesses the potential effects of the 2024 parliamentary elections on Iran’s digital policy landscape with pivotal questions: How might the new parliament impact digital access and infrastructure, digital rights and freedoms, and regulatory frameworks and governance? These questions are essential in understanding the potential shifts in Iran’s digital landscape, especially in light of the recent elections marked by significant abstention rates and criticized for their lack of freedom and fairness. This analysis is particularly concerned with the implications for Iran’s youth, who stand at the forefront of the digital transformation yet find themselves increasingly marginalized by the prevailing political and policy landscape.
Minimal Shifts: New Parliament, Old Policies
The Iranian Parliament, known as the Islamic Consultative Assembly, serves as one of the legislative pillars of the Islamic Republic of Iran. As outlined in the Constitution, it comprises representatives elected directly by the populace, who serve four-year terms. The Assembly’s primary functions include legislating and overseeing the implementation of laws.
The recent legislative elections in Iran took place on March 1, 2024, for the initial round, with a subsequent round following in May. These elections occurred simultaneously with the sixth session of the Assembly of Experts’ elections. Among the 290 available seats, 245 were decisively allocated in the first round. Out of the 245 elected representatives, 203 belong to various coalitions within the conservative (Osool Garayan) faction, with all candidates progressing to the second round also hailing from this faction, and the rest belong to independent candidates and candidates of religious minorities.
The widespread election of conservative representatives to parliament is unsurprising and is closely tied to the regime’s overarching strategy to consolidate power. Between 1997 and 2020, there was political rivalry between the conservative faction, mainly embodying radical Islamist perspectives and ideologically aligned with Iran’s leadership, and the reformists (Eslah Talaban). However, as internal discontent grew and a substantial portion of the reformist movement backed the public’s demands, there was an increase in silencing any opposition to benefit conservative parties. This process, known as “purification” or “election engineering,” underscores the Guardian Council’s role as the legislative system’s second pillar in molding the electoral landscape to favor conservatives.
The Council’s expansive interpretation of its oversight role, coupled with the supreme leader’s influence over its composition, has facilitated a more stringent oversight and regulation of digital environments in Iran. The recent elections have further highlighted a trend towards narrowing the electoral competition to benefit hardliner conservatives, many of whom support the Cyberspace Users Rights Protection and Regulation of Key Online Services 2022 (the Protection Bill). Awaiting official ratification by the Council, a significant portion of this bill’s measures has already been enacted through directives from the Supreme Council of Cyberspace (SCC).
Heightened interference in elections and the restriction of voter choices have sparked civil backlash. The 2021 presidential election, with a 48% turnout and 13%invalid votes, underscored this growing trend. The March 2024 parliamentary elections in Iran further highlighted the issue, recording a historically low turnout of approximately 41%. This marked decline in electoral participation signals widespread civil unrest and increasing disenchantment with the political system. A 2024 survey revealed significant dissatisfaction with President Raisi’s administration and the performance of the parliament, showing disapproval rates of 65% and 61%, respectively. The reluctance to engage in the voting process stems from a profound mistrust in both the candidates and the governing bodies, compounded by a feeling of ineffectiveness of one’s vote. This sense of disconnection is especially acute among young Iranians, many of whom are contemplating emigration due to unemployment, governmental encroachments on personal freedoms, and a bleak outlook on their future prospects in Iran.
Iranians and the Digital Sphere
Despite a long-standing history of political oppression, media censorship, and limited access to information, Iranians have consistently leveraged social media as a dual-purpose tool for activism and economic opportunity. This narrative is particularly pronounced during three critical periods of uprising: in 2009 and 2022, as well as the period in between.
The 2009 Green Movement stands as a critical moment in the history of social media’s influence, resonating within Iran and throughout global social movements. Young, technologically adept Iranians leveraged these platforms to share first-hand accounts, photographs, and videos of the protests, culminating in what has been termed Iran’s Twitter Revolution.
The period between 2009 and 2022 was marked by aggressive suppression of free speech, the systematic elimination of political dissent, and targeted actions against opposition factions. The economic landscape, already precarious, deteriorated further following the U.S.’s withdrawal from the Joint Comprehensive Plan of Action (JCPOA), leading to widespread public discontent and despair. The disillusionment deepened as anticipated reforms failed to materialize, leaving many Iranians disenchanted with their governance. However, alongside this political clampdown, a digital renaissance was quietly unfolding among the Iranian populace.
The arrest and subsequent death in custody of 22-year-old Mahsa Amini in September 2022 ignited a fresh wave of dissent. Only in the three months following Amini’s death, more than 280 million hashtags (tweets and retweets) in Persian were generated, underscoring the significant role of social media in mobilizing and amplifying public dissent in Iran.
From an economic perspective, the digital domain is of significant importance to Iranians. As reported by the head of Iran’s E-Commerce Development Center, in 2022, the total size of the country’s official e-commerce market was approximately $2 billion. Furthermore, financial transactions within the social media space for the same year were estimated to be around $600 million. Notably, this volume of transactions accounts for about 3% of the overall economic magnitude of the country’s e-commerce sector.
Digital Chains: Iran’s Controlled Cyberspace
In recent years, Iran has embarked on targeted initiatives to systematically enhance its control and oversight within the digital realm, notably across three key areas: digital infrastructure, content regulation, and governance structure modifications.
Governance Structure
In Iran, the regulatory framework and decision-making processes governing the digital domain are firmly under government control. The entities involved in these decision-making processes cover a wide array of governmental bodies, institutions operating under the aegis of the supreme leader, and military organizations. At the heart of this regulatory landscape is the National Security Council (NSC), endowed with the power to enforce Internet shutdowns. Established by Article 176 of the Constitution, the NSC is composed of 12 members appointed by both the President and the Supreme Leader, though its resolutions require the Supreme Leader’s ultimate approval. Additionally, Article 750 of the Penal Code 2007 mandates that all ISPs filter any content deemed criminal by the Commission to Determine the Instances of Criminal Content (CDICC). Led by the Prosecutor General, the CDICC is responsible for identifying such content, underscoring the extensive measures in place to regulate digital content within the country.
Nevertheless, the SCC emerges as the paramount institution for policy development within the nation’s digital sphere. Created by a decree from the Supreme Leader, the SCC boasts a composition of 17 members drawn from a variety of government agencies, with an additional 10 members directly appointed by the Supreme Leader himself. The formation of the SCC signifies a deliberate effort to centralize the policymaking and regulatory supervision of Iran’s digital environment, significantly reducing the roles and influence of the executive, legislative, and judicial branches in this area.
The Protection Bill aims to legitimize the establishment of the Supreme Regulatory Council (SRC), which is already founded by the SCC. A detailed examination of its membership, which includes representatives from the Islamic Revolutionary Guard Corps (IRGC), intelligence services, and the police, along with the extensive scope of its authority—encompassing policy making, oversight, guidance, coordination, and the establishment of regulations and procedures across all aspects of cyberspace and for sector-specific regulators—indicates that the SRC is poised to supersede the SCC with even broader jurisdiction. This Commission is also tasked with the approval of management standards for both domestic and international cyberspace traffic, a duty that was previously the purview of the Data and Communication Company (DCC), the nation’s principal ISP. This power delegation to the SRC heightens pre-existing worries about the potential for arbitrary actions within Iran’s digital policy management. Moreover, the re-election of key architects of the Protection Bill signals an enhancement of the SRC’s decision-making authority, hinting at the continuation and escalation of efforts to regulate social behavior and restrict digital freedoms.
Infrastructure
Iran’s primary strategy for Internet infrastructure centers on the development of the National Internet Network (NIN). Often referred to within Iran as the “Chinese model of Internet governance“, this strategy has been implemented in various facets over the past decade, guided by the Supreme Leader’s directives. The strategy encompasses several inter-connected areas, including the expansion of physical infrastructure, tariff-setting, and centralization to control access and manage content.
Physical Structure: Over recent years, there has been a gradual enhancement in Internet access, bandwidth, and speed, primarily due to governmental investments in Information and Communication Technologies (ICT). In 2020, the SCC targeted to set five-year goals for the NIN’s expansion. With President Raisi taking office, the Ministry of ICT made it a priority to advance the NIN, aiming to reduce Iran’s dependence on the global Internet. By February 2023, the National Center for Cyberspace (NCC) reported achieving 86% of the NIN’s operational objectives, underscoring continuous investments in fiber-optic infrastructure and Long-Term Evolution (LTE) mobile networks. The Seventh Development Plan 2023-2028 stands out for its optimistic and visionary stance, pending the approval of the incoming parliament. This initiative sets the stage for the establishment of a National Strategy for Digital Economy Development and the drafting of a National Program to Boost Digital Skills across the nation, with the ambitious goal of extending fibre-optic connectivity to 20 million households by the end of 2025. The Grand Plan and Architecture Specification of the National Information Network 2020, which outlines the network’s operational goals, aims for 80% of households to have fixed broadband access at an average speed of 25 Mbps and for the entire population to have mobile broadband access at an average speed of 10 Mbps.
Tariff-Setting System: Despite the optimism regarding initial plans, experts are raising concerns that the strategies for Internet tariffing, designed to bridge the digital divide, might not be as realistic as hoped. The ambitious Grand Plan proposes a 70 to 30 ratio for domestic versus international basic service traffic and aims for a 15%annual growth rate in this area. Earlier, based on the National Information Network Requirements Roadmap 2017 (NINRR), all ISPs have been mandated to offer users a 50% discount on the cost of accessing websites with domestic traffic and to charge only a third of the price for the use of local messaging applications. However, a 2022 report from the Ministry of ICT reveals a stark contrast: 80% of the country’s Internet traffic is international, relying on servers outside Iran, with only 20% being domestic. This discrepancy suggests that the high cost of tariffs significantly restricts Internet access for many Iranians, despite the physical infrastructure being in place. In this regard, in January 2024, Iranian ISPs increased their international data prices for the third time in a single year by 7 to 34%. This reliance on international traffic is further exacerbated by the escalating costs of accessing international data, which, coupled with a dramatic decline in purchasing power and increasing poverty rates among Iranians, poses a formidable barrier to Internet access across the nation.
Acknowledging the limitations of the current preferential tariff system, the Ministry of ICT in 2023 pursued legislative endorsement for a more adaptable tariff framework that considers the nature of the content, marking a departure from the original Grand Plan and the NINRR. This initiative, ratified by the previous parliament through Article 19 of the annual budget, centralizes the tariff-setting authority within the Ministry of ICT and regulatory bodies such as the CSR. On the other hand, the Protection Bill encourages users towards services that adhere to local standards by imposing a bandwidth usage cap on international services, aiming to consolidateInternet infrastructure and services under the NIN.
Centralized Decision-Making Center: The NIN provides the government with the ability to exert extensive control and supervision, as demonstrated by the almost complete Internet shutdowns across the country in 2019 and 2022. Additionally, this level of control enhances the government’s capacity for censorship and monitoring, forcing citizens to depend on local applications and platforms, which frequently fall short in terms of privacy and security measures. A 2022 research has revealed that the Communications Regulatory Authority utilized Service Integration and Management technology for the targeted slowing of mobile services on specific devices.
Ahead of the March election, a Directive from the SCC regarding the access to useful foreign services through internal “shells”, mandates that this access be provided solely via the NIN. This directive emphasizes the creation of technical solutions that enable Iranians to utilize international services through “windows of access” embedded within local platforms or altered versions of foreign platforms, circumventing blocks on their main versions. These internal shells, or national APIs, aim to bolster e-commerce for Iranian businesses on renowned foreign platforms by introducing functionalities such as in-app payments, which are currently not viable due to sanctions.
The SCC’s mention of “governing shells” raises concerns about potential privacy intrusions. While there is a global debate on the role of anonymity in social networking—with increasing calls for identifiable online interactions to enhance accountability and deter cybercrimes—user anonymity remains a critical aspect for many, supporting free expression and protecting privacy. The introduction of these shells could compromise user anonymity, risking exposure of user identities and increasing the potential for data breaches through internal server hacks.
In January 2024, drawing on the Citizens’ Rights Charter that acknowledges the right to cybersecurity, personal data protection, and privacy, the NCC introduced new guidelines aimed at safeguarding personal data. This guideline is designed to mitigate the risk of privacy violations and shield users’ sensitive information from cyber threats, requiring private entities to comply with updated regulations for processing and storing user-related data on digital platforms. However, this guideline does not apply to government institutions such as the judiciary, which has recently been the target of widespread hacker attacks, resulting in the leak of citizens’ sensitive data. Moreover, the guideline uses broad language and, in many cases, refers to the yet-to-be-approved new version of the Protection of Data and Privacy in Cyberspace Bill 2023. This new bill significantly diverges from its predecessor, the Personal Data Protection and Safeguarding Draft Act 2017, by allowing authorities access to and the processing of the mentioned data for various purposes, including public security, national security, national interests, crime prosecution, or maintaining public health and safety, without providing a clear definition of these concepts.
Digital Content
In a notable development within Iran, the Citizenship Rights Charter 2016, although not legally binding, acknowledged the right to access public information. This acknowledgment supported the Executive Bylaw of Article 8 of the Freedom of Information Act 2015 and Subsequent Amendments. This bylaw establishes a legal structure that allows citizens to obtain information from government bodies and certain private entities. Despite these advancements, a range of regulatory and economic hurdles still obstruct the ability of users to publish content online.
As explored in the “Infrastructure” section above, the Internet’s preferential tariff system has led to higher costs for the majority of Iranian users, particularly those whose data is routed through servers abroad. This issue is compounded by the significantly low quality of Internet access for average users. In December 2023, Iran was ranked 47th among 50 countries, with an 11%t rate of disruption. Another report in 2024 on Internet quality in Iran labels the country’s Internet situation as critical, attributing network problems and disruptions to deliberate policy choices rather than underdevelopment. Furthermore, the implementation of “tiered Internet access”, a government initiative providing special SIM cards for unrestricted Internet access to foreign tourists, effectively positions Iranian users as second-class citizens. This policy underscores their awareness of being denied the fundamental right to freely access information within their own country.
Stringent regulations also significantly restrict freedom of expression online, imposing severe consequences on those who defy these rules or unintentionally provoke governmental authorities. For example, the Press Law 2009 forbids the issuance of materials that contravene Islamic values or public rights, although these concepts are ambiguously defined. The Computer Crimes Law 2009 outlines penalties for a range of cyber offenses, such as espionage, unauthorized access, and the distribution of materials that offend “public decency” or entail the “spread of falsehoods,” with punishments varying from capital punishment for ethical violations to extensive incarceration, substantial fines, and additional penalties for service providers failing to adhere to governmental content guidelines.
The Protection Bill mandates that international technology companies appoint a legal representative in Iran to adhere to Iranian laws and support the government’s efforts in online monitoring and censorship. Non-compliance will lead to a gradual censorship strategy, starting with bandwidth throttling and escalating to a total shutdown once a local alternative within the NIN becomes available. Yet, international tech firms, particularly those linked to the U.S., face legal prohibitions against complying with these requirements due to extensive U.S. sanctions on Iran. In the unlikely event that international tech companies without U.S. affiliations choose to comply, it would adversely affect Internet users throughout Iran. Furthermore, the bill explicitly prohibits the creation and distribution of tools designed to circumvent censorship, such as virtual private networks (VPNs) and proxy services, which are widely utilized in Iran to access globally available Internet services, and requires service providers to collect and store user data, termed “electronic evidence”, which must be handed over to the authorities upon request.
The Bill to Protect Families by Promoting the Culture of Modesty and Hijab 2023, a highly debated legislative proposal that newly elected parliament members are eager to pass and has received support from the Regime, poses significant concerns regarding privacy and discrimination. Article 24 of the bill authorizes intelligence services and the IRGC to track individuals in cyberspace advocating for the removal of the hijab. Additionally, Article 28 mandates that the police enhance and develop smart detection systems, utilizing artificial intelligence to identify those engaged in unlawful acts. This surveillance responsibility extends beyond police and government agencies as Article 64 compels various service providers, including private banks, transportation companies, retail outlets, professionals, and residential complex managers, to upgrade their surveillance cameras for better image quality and to store footage for at least twenty days.
Conclusion
Despite international sanctions, particularly in the digital domain, the Internet has been critically important for Iranian society over the last two decades, especially as a platform for activism. However, this progress has been countered by policies that not only neglect the development of vital infrastructure and data protection regulations, which are crucial for economic benefits, but also intensify various restrictive measures.
The previous parliament, with its conservative majority, has failed to enact laws that would enhance public access to the Internet. This is apparent in legislative proposals like the Protection Bill and the Bill on Hijab and Chastity, which aim to employ modern technology for extensive public surveillance. Moreover, the disqualification of many opposition candidates, who might have influenced a shift in parliamentary stance, and the re-election of a majority of conservative figures highlight the continuing emphasis on reinforcing non-democratic entities like the SCCR. Consequently, substantial reforms in Internet governance appear improbable.
Written by Hesam Norouzpour (Edited by Pham Thu Ngan)