Traces of Iran’s Internet shutdown in Tor network activity

Iran shutdown Internet access “to prevent the enemy’s misuse,” according to its Ministry of Communications. The Iranian government this time completely blocked not only outbound communications but also inbound international internet traffic to the country, document Filter Watch.

Timeline of significant events based on Filterwatch’s findings and IODA records

  • June 13 – Beginning of Widespread Disruption
  • June 15 – Regional Communication Collapse
  • June 16 – Official Announcement of Speed Reduction
  • June 17 – First Widespread Internet Blackout
  • June 18- Second Widespread Internet Blackout
  • June 19 – Continued Widespread Internet Blackout
  • June 21 – A partial restoration of Internet connectivity

Here is a summary of how this Internet shutdown was observed from the Tor network:

First, a dramatic drop in direct connections to the Tor network was observed when the Beginning of Widespread Disruption on June 13 was recorded, during which blocks to services such as WhatsApp, Cloudflare, and others were reported and identified.

Jacobo Nájera / Acuarela Taller with data from Tor Metrics

Second, an abrupt increase in Tor bridge users was recorded on the same day, surpassing 30,000 users.

Jacobo Nájera / Acuarela Taller with data from Tor Metrics

Third, a drop in bridge connections to the Tor network was observed when the Regional Communication Collapse was recorded. This situation indicates that these operators experienced severe disruptions in international data exchange and responsiveness to external networks.

Fourth, a recovery in bridge connections to the Tor network was recorded at the same time as a partial restoration of connectivity in Iran was observed on june 21.

Conclusion

The data from the Tor network show that it was able to maintain connections from Iran using bridges until Regional Communication Collapse when Iran implemented its filtering architecture, it enforced a total blockade not only of outgoing communications but also of incoming international Internet traffic to the country, known as the “National Information Network.”Meanwhile, direct connections were lost during the initial disruption.

Finally, at the time of partial restoration, connections through bridges were successfully reestablished and are still being restored. For this reason, bandwidth contributions from volunteers through Snowflake and obsf4 continue to be useful.

References

Iran’s Internet Status in the First Week of Israel’s Attack: Disruption More Severe Than Bloody November in 2019

Tor Metrics

The drop in traffic is visible in routing data recorded by IODA

A partial restoration of Internet connectivity is observed in Iran after an approximately 62-hour shutdown imposed by the Ministry of Telecommunications, routing data