Internet Shutdown For The Many, Access For The Few
A look at the network of whitelisted accounts influencing the online narrative around the war in Iran as “voices of the nation.”
For more than two months now, Iran has experienced one of its longest sustained nationwide internet shutdowns. While millions are disconnected, a select group of individuals and entities in Iran continue to enjoy unfettered access to the internet.
Digital Authoritarianism has traditionally operated through systematic censorship and network-level blocking to prevent access to global information. These measures are often combined with communication monitoring and cyber-attacks to identify, deter, and persecute journalists, civil society, and dissenting voices. What we are now observing in Iran represents an evolution of these practices.
Digital authoritarianism in Iran has evolved rapidly over the past decade, driven by technological advances and shifting political landscapes. A key characteristic of this evolution is growing coordination across state-controlled or state-sponsored media, digital infrastructure, and large-scale information operations. Its consequences transcend national borders, affecting not only citizens within authoritarian regimes but also unsuspecting and vulnerable communities abroad, ultimately destabilizing the cohesion and stability necessary for democratic systems.
The Islamic Republic is pushing the boundaries of digital authoritarianism by combining internet shutdowns with the coordinated use of social and traditional media to manipulate, shape, and influence public debate and policy. Concurrently, a whitelist-based architected, enabled by the National Information Network (NIN), aims to silence dissent while amplifying state-aligned content through information manipulation, social media algorithms, and AI and language models, including through the strategic production and dissemination of state-generated information. Iranian official accounts on X have also shifted to posting provocative and often AI-generated content to drive engagement, gaining hundreds of millions of views in the early weeks of the war.
Over time, this contributes to shaping the broader information environment in ways that favour state narratives. This research looks at how networks of whitelisted accounts continue to publish steadily on global platforms, particularly on X, transforming the internet shutdown into a mechanism for influencing the online narrative around the war in Iran as “voices of the nation” while the millions of voices in Iran are silenced.
Executive Summary
Since early January 2026, internet connectivity across Iran has been subjected to severe, prolonged shutdowns in response to political unrest and military escalation. However, traffic data and social media analysis confirm that the digital blackout does not affect everyone equally. Instead of a total disconnection, authorities in Iran leverage the National Information Network (NIN) to implement a default-closed “whitelist” architecture. This system effectively severs the global internet access for the general public while maintaining uninterrupted connectivity for a politically authorized class of users the state has white-listed to have unfettered access to the internet. While millions of ordinary citizens were plunged into digital darkness, this structured subset of accounts continued to publish steadily on global platforms, particularly on X, transforming the shutdown into a mechanism for curating a state-managed information and narrative environment.
Tracked data shows that between December 2025 and April 2026, a heterogeneous network of 97 verified accounts based in Iran produced more than 70,000 posts. This persistent outward-facing communication demonstrates the Iranian state’s policy to completely isolate its domestic population and silence their voices online, while pushing its message and narratives to international audiences to reshape the image of the Islamic Republic.
The analysis reveals two distinct phases in how this infrastructure was deployed: the January shutdown saw a narrow and less operational tiered-access layer, primarily supporting institutional media and diplomatic nodes. In contrast, the post-February shutdown phase showed a broader, more operational tiered communication layer, including institutional media, commentators, parliamentary figures, and lower-visibility amplification accounts. This shift suggests the system evolved from a reactionary communication strategy to a prepared and distributed network for sustaining narrative continuity.
Over time, this contributes to shaping the broader information environment in ways that favour state narratives. This research looks at how networks of whitelisted accounts continue to publish steadily on global platforms, particularly on X, transforming the internet shutdown into a mechanism for influencing the online narrative around the war in Iran as "voices of the nation" while the millions of voices in Iran are silenced.
Key Findings
Iran has fundamentally shifted its digital control strategy from a traditional “blacklist” to a default-closed “whitelist” model. By relying on the domestic infrastructure of the National Information Network (NIN) and identity-linked subscriber databases, the state can now cut off the general public from the global web while selectively granting privileged access—such as “white SIMs” and “Internet Pro” connections—to state-approved actors and loyalists.
Despite nationwide blackouts, a highly structured and heterogeneous communication layer maintained an explosive digital output. Rather than eliminating communication, the shutdowns redistributed it. A curated network of institutional actors, parliamentary figures, and lower-visibility amplifiers remained continuously active, proving that this tiered access functions as a structural tool for sustaining narrative dominance during crises.
Externally visible content emerging from Iran during these crises is a highly curated illusion, not a reflection of domestic public opinion. The stark asymmetry in internet access creates an environment where the digital signals reaching global audiences disproportionately represent a politically authorized “voice of the nation” ecosystem. This outward visibility effectively masks the silence of the broader, disconnected Iranian populace.
During the January 8–18 internet shutdown imposed after the nationwide protest crackdown, 64 of the 97 verified Iran-based accounts identified in the dataset continued posting on X while much of the country experienced a near-total blackout. The accounts active during this period consisted primarily of state-affiliated journalists, academics, and institutional media actors, suggesting that the first shutdown preserved connectivity for a narrower communication tier centered on institutional and externally oriented messaging.
The wartime shutdown imposed after the February 28 U.S.-Israeli strikes operated through a significantly broader communication layer. Nearly 40,000 posts were identified in the sample during this period, with sustained activity appearing across institutional media organizations, parliamentary figures, foreign-policy commentators, military-focused channels, pro-Islamic Republic users, and lower-visibility amplification accounts. Compared to the January shutdown, the scale and diversity of activity during the wartime period suggest a more operationalized tiered-access system designed to maintain narrative continuity during conflict.
The Chosen Voices: Selective Access in a Total Shutdown
Since early January 2026, internet connectivity in Iran has been repeatedly shut down in response to political unrest and military escalation. On December 28, 2025, protests erupted in Tehran, initially led by shopkeepers and merchants in the Grand Bazaar following the collapse of the national currency and rising prices, quickly spreading nationwide in what became the largest wave of unrest in Iran’s modern history. In response, the Islamic Revolutionary Guard Corps (IRGC), Iran’s armed forces, carried out a coordinated nationwide crackdown, massacring thousands of civilians.
A nationwide internet shutdown began on January 8 in reaction to the protests and was only partially restored on January 18. The second shutdown began on February 28 during the U.S. and Israeli strikes and has remained in effect for weeks, with no end in sight. For civilians, these shutdowns mean being cut off from information, emergency services, and digital infrastructure in moments of crisis, while also obscuring state-sponsored mass atrocities and exacerbating the economic crisis.
Traffic data from independent internet monitoring organizations such as Kentik and IODA recorded a sharp drop in internet activity across Iran during the shutdowns. Measurements reflecting everyday internet use, including browsing activity and connectivity signals from users, collapsed across the country. Yet Iran’s international internet infrastructure itself remained online and technically connected to the global internet. The contrast indicates that authorities were selectively restricting internet access for users inside the country while keeping Iran connected to the global network. IODA Dashboard provides great insights and data on Iran’s Internet connectivity.
However, the shutdown has not affected all users equally. While most of the population lost access to the global internet, state-approved users continued publishing steadily on social media platforms, shaping the information reaching international audiences about Iran. These accounts included media figures, commentators, institutional actors, diplomatic messaging channels, and pro-government social media users.
Understanding who these accounts are, and how they behaved during the shutdown, provides insight into how selective internet access was used in practice to shape narratives online inside and outside Iran during recent periods of unrest and conflict.
Privileged Connections: Tracking State-Approved Accounts Through Internet Blackouts
This analysis tracks posting behaviour on X among a defined group of Iran-based accounts that remained active during recent internet shutdowns in Iran between December 20, 2025 and April 23, 2026. The observation period spans the 2025–2026 protests and the February 2026 Iran–Israel–United States war.
The dataset used in this report was compiled from multiple sources. Accounts were initially identified through the WhiteSimWatch website, which tracks X accounts that maintain internet access from inside Iran during government-imposed shutdowns. Historical posting data across both observation windows was primarily collected through the Exorde Labs database, while the official X API was used to validate the dataset and replace missing posts where gaps appeared in the primary collection.
The full list of accounts included in the research sample is provided HERE.
To define the sample, two selection criteria were applied: accounts had to be listed as based in Iran and hold verified status on X. Both criteria were independently reviewed through the platform’s transparency window. The “based in” label identifies the country or region associated with an account, while the verification badge confirms that the account holds an active paid subscription on the platform. The transparency window also displays a separate “connected via” label indicating the platform or app store region used to access the account, such as web, iOS, or Google Play.
In total, 97 accounts were independently verified as meeting both selection criteria at the time of analysis and identified 74,449 posts. Yet a later review found that a few of these accounts no longer appeared verified on the platform. This may reflect X’s policy of removing verification from certain Iranian state-affiliated accounts following reports that the platform had provided paid services to sanctioned entities in violation of U.S. sanctions, though some users may have also voluntarily ended their subscriptions.
Screenshot of the “About this account” transparency window for a verified Iranian user on X. The account is identified as whitelisted because it maintains active access from within the country despite general restrictions. The profile also displays the “Connected via” label, which identifies the specific app store region used to download the platform.
In order to better understand the types of accounts that remained active during the shutdowns, the self-declared biographies of the 97 accounts were reviewed. The profiles point to a broad mix of actors, including media figures, commentators, academics, diplomats, political actors, and institutional entities.
January Protests: Justifying the Massacre During the Blackout
The nationwide internet shutdown that began on January 8, 2026, marked one of the clearest deployments of Iran’s tiered-access communication system during a domestic crisis. While the general public faced a near-total cutoff from the internet and social media platforms, a selected group of state-approved users remained active online. Even during the peak of the blackout between January 8 and the beginning of partial restoration on January 18, 64 accounts from the sample continued publishing content.
The accounts active between January 8 and 18 consist of state-affiliated journalists, academics, and media outlets. These users represent a select tier of professionals whose roles grant them the connectivity required to maintain a presence and shape narratives while the rest of the country remains offline.
Posts shared during this period largely reinforced narratives aligned with the state crackdown. Accounts that retained access described the unrest as foreign-backed sabotage, terrorism, and organized violence, repeatedly linking protesters to the CIA, Mossad, armed groups, and external enemies. Other posts emphasized pro-government demonstrations, highlighted unrest in Western countries, and mocked opposition figure Reza Pahlavi [Link 1] [Link 2] [Link 3] [Link 4] [Link 5].
The information environment presented by these accounts contrasted sharply with reports emerging from inside Iran, where thousands of civilians were reportedly killed during the crackdown while much of the population remained offline.
Wartime Shutdown: Projecting Strength and Victory Online
On February 28, 2026, following the U.S.-Israeli airstrikes, Iranian authorities imposed a wartime internet shutdown. Unlike the January protest blackout, activity among whitelisted accounts expanded significantly during this period and operated through a broader and more coordinated communication layer that remained active throughout the disruption.
Nearly 40,000 posts were identified in the sample during this period. Continuous activity appeared across a much wider network of accounts, including state-affiliated media organizations, foreign-policy commentators, parliamentary figures, military-focused channels, pro-Islamic Republic users, and politically aligned online accounts. Meanwhile, the general population inside Iran remained cut off from global platforms.
Content published during the wartime shutdown frequently projected military strength and victory while circulating unverified or false battlefield claims. For instance, multiple posts falsely claimed that Iranian forces had shot down advanced U.S. fighter jets such as the F-35 and F-18. Other posts threatened aircraft carriers, warned of new restrictions in the Strait of Hormuz, attacked Gulf states such as the UAE, and used anti-Jewish rhetoric [Link 1] [Link 2] [Link 3] [Link 4] [Link 5].
Who Are the White-Listed Voices?
Analysis of account-level activity across the dataset shows that the actors who remained visible online during the shutdown did not belong to a single institutional category. Instead, they formed a heterogeneous but structured communication layer spanning multiple sectors of the state-aligned narrative environment.
The sample includes several distinct categories of accounts, including state-affiliated media organizations such as ISNA, foreign-policy messaging figures such as Mohammad Marandi, parliamentary actors including Jalal Rashidi Koochei, military-focused information channels such as Iran Military Media and Iran Military News, aligned social media commentators, and lower-visibility amplification accounts operating within narrative support networks.
The presence of these different actor types suggests that connectivity continuity during the shutdown was not restricted to formal state institutions. Instead, it extended across a broader ecosystem of accounts involved in shaping public messaging for both domestic and international audiences. Iranian officials have at times described such authorized communicators as the “voice of the nation,” reflecting the political function assigned to this layer during crisis conditions.
This pattern is particularly visible in the persistence of accounts that do not occupy prominent institutional roles but maintain continuous posting activity during shutdown intervals. Their inclusion indicates that tiered access functioned not only as a mechanism for preserving official communication channels but also as a tool for sustaining narrative amplification capacity across multiple visibility levels.
Evidence from parallel platform-level monitoring supports this interpretation. Independent analysis by Factnameh of Telegram channel activity during the January 2026 shutdown similarly found that only a limited group of state-linked and IRGC-affiliated media networks remained consistently active while most independent outlets fell silent, reinforcing the conclusion that selective connectivity operated across multiple platforms rather than within a single communication environment.
Taken together, these observations support the conclusion that selective connectivity during the shutdown operated as a structured communication layer rather than an ad hoc exception applied to a small number of officials.
Case Examples: From Institutional Messengers to Low-Visibility Amplifiers
Account-level activity within the dataset illustrates how tiered connectivity supported a range of actors occupying different positions within the state-aligned narrative environment.
Among the most visible figures in the sample is Mohammad Marandi, whose English-language commentary has frequently appeared in international broadcast media during periods of regional escalation. His continued posting activity during shutdown intervals illustrates how externally oriented messaging channels remained active despite restrictions affecting the broader population and reflects the role of informal external-facing spokespersons within the tiered-access communication layer.
The dataset also includes parliamentary figures such as Jalal Rashidi Koochi, who has publicly positioned himself as a critic of internet filtering policies while maintaining continuous access to global platforms during shutdown periods. Koochi’s account has since been suspended by X. The presence of such actors highlights the political complexity of selective connectivity and its role in preserving a controlled form of visible plurality within the communication space.
At the same time, several lower-visibility amplification accounts maintained sustained posting activity across the observation window. Although these actors attracted less public attention individually, their cumulative output contributed to maintaining a continuous layer of aligned narrative reinforcement during periods when independent voices inside the country were largely absent from global platforms.
The coexistence of high-profile commentators, institutional media actors, parliamentary figures, and lower-visibility amplification accounts within the same activity distribution suggests that tiered connectivity supported a distributed communication network rather than a narrow set of official spokespersons.
This distributed structure helps explain how narrative continuity from inside Iran persisted throughout the shutdown despite the collapse of general access to global platforms for most users inside the country.
The “Voice of the Nation”: A Politically Authorized Communication Layer
Statements by Iranian officials during recent nationwide internet shutdown periods provide important context for interpreting the activity patterns observed in the dataset. Rather than denying the existence of selective connectivity, authorities have repeatedly framed privileged access as a necessary mechanism for preserving the country’s ability to communicate with external audiences during crisis conditions. In public remarks during recent shutdown periods, officials described selected communicators who retained access to global platforms as representing the “voice of the nation.”
In March, government spokesperson Fatemeh Mohajerani publicly confirmed that authorities were using a whitelist system during the shutdowns. She said internet access was being granted only to selected users and organizations “who can better deliver the message.” Her remarks openly tied internet access to political and communication roles during the crisis.
The same logic appeared in comments by Abbas Araghchi, who serves as Iran’s Foreign Minister, during an interview with Face the Nation. When asked why he still had internet access while much of the country did not, Araghchi replied: “Because I’m the voice of Iranians.” He defended the restrictions as necessary for security reasons and described the internet as limited and managed during the conflict.
This framing effectively establishes a politically trusted layer of users who remain authorized to speak outward while the broader population’s access to global platforms is restricted. In practice, many of these accounts retained connectivity through tiered-access mechanisms commonly referred to domestically as white SIM access, alongside institutional connectivity channels allocated to selected media organizations and public communication nodes.
Activity patterns in the research sample closely match this description. Accounts that remained continuously active during shutdown periods include foreign-policy commentators publishing in English, institutional media actors addressing domestic audiences, parliamentary figures maintaining visibility on policy debates, and security-aligned channels circulating conflict-related interpretations.
The presence of these actors within the same continuity layer suggests that tiered connectivity functioned as an instrument for preserving narrative transmission capacity during periods of restricted public communication rather than as a narrowly technical exception for administrative use. In addition to official communication structures, journalistic connectivity tiers administered through regulatory bodies such as the Ministry of Culture and Islamic Guidance appear to have formed part of this authorized communication environment.
Importantly, this communication layer operated across both Persian-language and English-language spaces. This bilingual presence indicates that selective connectivity supported not only domestic narrative management but also outward-facing messaging intended for international media environments during shutdown periods.
Why Visibility Was Not Representation
One of the central implications of the dataset is that observable activity from inside Iran during the shutdown cannot be interpreted as a proxy for public opinion.
During the shutdown periods examined in this report, millions of users inside the country experienced restricted access to global platforms. At the same time, more than one hundred accounts in the research sample continued to publish steadily across multiple weeks of reduced connectivity.
This asymmetry created a visible information environment in which externally accessible content from inside Iran disproportionately reflected the perspectives of actors operating within the tiered-access layer.
The persistence of posting activity among these accounts therefore, does not indicate that communication conditions inside the country remained stable. Instead, it reflects the selective preservation of a limited communication channel through which specific institutional, political, and narrative actors remained visible.
This distinction is particularly important for international observers. During extended connectivity disruptions, externally accessible content originating from inside Iran may appear to represent a cross-section of domestic discourse while in reality reflecting a filtered subset of voices able to maintain access to global platforms. Similar asymmetries were observed in parallel platform-level monitoring of Telegram channels during the same shutdown periods.
The dataset examined in this report demonstrates that narrative continuity during shutdown periods was sustained not by the population at large but by a structured layer of actors whose connectivity conditions differed from those experienced by most users.
Conclusion: A Managed Information Environment
The Islamic Republic is pioneering a sophisticated model of digital authoritarianism, combining internet shutdowns with strategic use of traditional and social media to manipulate public discourse. A key architectural element of this strategy is the National Information Network (NIN) and its whitelist-based architecture, designed to silence dissent while promoting state-aligned content.
A key finding of this analysis is that observable online activity from within Iran during shutdowns cannot be treated as a reliable proxy for public opinion. Instead, it reflects the output of a selectively connected subset of accounts operating within a tiered-access system.
For international observers, this distinction is crucial. During connectivity disruptions, content originating from within Iran may appear representative of domestic discourse, but in practice, it constitutes a filtered subset of voices that can maintain access to global platforms. The data confirms that narrative continuity during shutdowns is sustained not by the general population, but by a structured layer of actors with privileged connectivity.
The overall outcome is a state-managed information environment. The disruptions function as a controlled reconfiguration of outward visibility, preserving communication capacity for institutional media, political figures, military-aligned channels, and other pro-state actors while restricting the broader population. By combining identity-linked subscriber controls, selective routing, and institutional access programs, the Iranian authorities have transformed internet shutdowns from simple silencing tools into mechanisms for curating which voices remain audible beyond Iran’s borders. This makes understanding the tiered connectivity architecture essential for correctly interpreting digital signals from Iran during times of crisis.