Iran’s Internet and the Politics of the Off Switch

An oil tanker can be stopped by a mine. A country’s internet can be cut without touching a wire.

The distinction matters now that Iranian officials have publicly warned that undersea internet cables near the Strait of Hormuz could become targets if Iranian infrastructure is attacked. In a 21 October broadcast carried by Press TV, Brigadier General Yadollah Javani, the Islamic Revolutionary Guard Corps’ political deputy, said Iran could use its capabilities against those assets in retaliation. That is a public, conditional threat. It is evidence of what a senior official said; it is not evidence that an order to cut cables exists, that Iran has the ability to sever every route, or that any cable has been attacked.

The more established lever is inside the country. Iran has repeatedly restricted mobile service, blocked platforms and disconnected people from the global internet. Network measurements show an online border tightening while domestic services continue, or connectivity falling almost to zero. Neither move damages a submarine cable or, by itself, closes Hormuz.

A documented history of turning access down

During the November 2019 protests, the authorities imposed a near-complete shutdown for several days. Georgia Tech’s Internet Outage Detection and Analysis project reports that Iran withdrew routing announcements, making affected networks unreachable from outside. Yet OONI measurements indicate that many users still had access to the National Information Network, Iran’s domestic network of state-supported services. The global internet had been cut back; the domestic network had not simply vanished. IODA’s comparison distinguishes those mechanisms.

In September and October 2022, OONI documented evening shutdowns on three major mobile operators while fixed-line and satellite access remained available. Its measurements also found blocks on messaging platforms, app stores and encrypted DNS. Mobile users could lose access during the curfew while other connections continued, interrupting communication without taking every household and business offline. OONI’s technical report combines those observations with Cloudflare data.

In June 2025, during conflict with Israel, Iranian networks remained visible in global routing data even as many services became difficult or impossible to reach. The Internet Society found that the disruption unfolded in phases, affecting DNS, web, email and VPN services, then recovering unevenly. A network can still appear on the internet’s map while the services carried across it stop working. Its service-level analysis explains why routing data alone can miss this type of shutdown.

There were two separately measured nationwide blackouts in 2026. First, on 8 January, during nationwide protests, Cloudflare recorded Iran’s traffic falling to effectively zero around 18:45 UTC; Access Now reported that mobile connectivity and international phone calls were also cut. Second, on 28 February, as U.S. and Israeli airstrikes began, a new shutdown reduced connectivity to near zero. Cloudflare later identified signs of restoration on 26 May, after an 88-day near-total outage. Cloudflare’s January measurements document the first event; its Q2 disruption review dates the second and the partial restoration. This article treats those events as verified because multiple measurement organizations recorded them. They are not evidence of a new October blackout.

As of the 24 October research cutoff, I found no authoritative measurement confirming that Iran has begun another nationwide shutdown this month. Filterwatch reported on 14 October that a Cloudflare traffic drop starting on 4 October coincided with user reports of VPN failures, and suggested a change in filtering methods. The report itself describes a possible shift in censorship, not proof that the country has gone dark. A change in a traffic graph can also reflect routing, service disruption, power loss or demand. Filterwatch’s account is a signal to watch, not an independent confirmation of a blackout.

How the border can close without cutting the cables

The internet is a network of networks. Providers advertise routes to addresses they can reach; others use those announcements to send data. Iran can restrict international traffic at a few gateways and leave domestic routes in place. It can withdraw routes or drop traffic at the border, or selectively block services, protocols and destinations. The fiber can remain intact while people cannot reach services abroad.

DNS translates a name such as a bank’s website into the address a device needs. If a resolver is blocked or returns a false address, a service may fail by name even when the route exists. Encryption can hide domain requests, but authorities can block known encrypted-DNS services or interfere with their connections. OONI recorded Iran increasing interference with DNS over HTTPS and TLS in 2022. The target is the path, not the seabed.

Iran’s National Information Network, often described as a national intranet, gives the state another option. Locally hosted services can be made reachable when international traffic is sharply restricted. But “domestic internet works” is not the same as “the internet is open.” Nor does it guarantee every domestic service will work: power failures, damaged data centers, cyberattacks, congestion and dependencies on foreign cloud or authentication providers can break local systems too. The United Nations Independent International Fact-Finding Mission on Iran documented the shutdown imposed on 28 February and said it cut off access to vital conflict updates, safe escape information and communication between people inside and outside the country. The Mission’s report describes the human consequences without implying that every domestic service failed.

What remains reachable, and for whom?

Banks are not a single on-off switch. Locally hosted payment services may keep working on domestic routes. A mobile banking app, card processor, authentication code or cloud dependency may not. A failed payment does not prove a bank’s ledger is offline, and a reachable bank does not guarantee cross-border transfers work. The question is which service depends on which route.

For families abroad, a message may not arrive and no one can confirm that relatives are safe. If phone calls and mobile networks are shut too, diaspora communities cannot rely on text, voice and social platforms as separate channels. Access Now reported that the January 2026 shutdown affected all three, reducing images and direct testimony available outside Iran.

That loss changes what outsiders can know. During a shutdown, fewer videos, eyewitness posts and geolocated records reach investigators. The remaining material is likely to be uneven: official accounts, a small number of whitelisted users, delayed messages, satellite links, or content that leaves only after connectivity returns. A blank feed is not proof that nothing happened. A single video is not proof of the whole picture. The UN mission said the February shutdown prevented access to updates and safe escape routes; it also makes later verification harder. That is a reason to preserve uncertainty, not a license to fill the gap with casualty or depopulation claims that the available evidence does not support.

The cable threat is a different kind of leverage

The International Cable Protection Committee says multiple cable systems pass through Hormuz, including systems with Gulf landings and two cables landing in Iran. It cautions that bandwidth through Hormuz is less than one percent of international bandwidth worldwide. The corridor matters to Gulf states; disruption would be regional first, with wider effects depending on damage and spare capacity. The ICPC’s 20 May statement corrects the claim that all global data passes through the strait.

One operator describes FALCON as a loop around the Persian Gulf, with landings in Iran, Oman and other Gulf states. Redundant routes do not make a cable invulnerable, but they show why “cut one cable, disconnect the world” is a poor description. Traffic may reroute with congestion or delay; multiple cuts or restricted repair access could make that harder. The operator’s FALCON description lists its landings and design.

Cable damage can affect several networks and countries; repair depends on permits, ships, safe access and spare parts. A state shutdown can leave cables available for others while restricting who inside Iran may use them. The two tools have different targets and consequences. Threatening one does not prove the other has happened.

The strait’s energy role makes the analogy tempting but imperfect. In 2024, oil flows through Hormuz averaged about 20 million barrels a day, around one fifth of global petroleum liquids consumption, according to the U.S. Energy Information Administration. A disruption to oil shipping can quickly change supply expectations and freight risk. The cable network is smaller in global share and has more routing alternatives, even if its loss would hurt regional communications and business. EIA’s data and the ICPC’s cable assessment describe two different chokepoints, with different consequences.

The signal to watch is corroborated evidence: operators reporting faults, cable systems publishing outages, measurements showing which networks have disappeared, and repair access being restricted. Cloudflare Radar, IODA, OONI and the Internet Society measure different layers; no one chart alone reveals whether a network is damaged, filtered or temporarily unreachable.

Iran has shown that it can use shutdowns as a way to constrain domestic communication and international visibility. Officials have now also made a public conditional threat against physical cables. Those facts warrant attention. They do not make a future cable attack certain, turn an unverified traffic dip into a total blackout, or establish that cutting connectivity would win a military or political objective. Control of information can be a lever in a crisis. It cannot substitute for evidence about what happened on the ground.

Sources

• Cloudflare: January 2026 shutdown measurements
• Cloudflare: Q2 2026 internet disruption review
• Access Now: Iran’s January 2026 communications shutdown
• IODA / Georgia Tech: Iran shutdown comparison
• OONI: Iran shutdown measurements, autumn 2022
• Internet Society: service-level measurements of Iran’s June 2025 shutdown
• UN Fact-Finding Mission on Iran, report A/HRC/61/60
• Filterwatch: Iran network monitoring, October 2026
• Press TV: IRGC deputy’s conditional cable threat, 21 October 2026
• International Cable Protection Committee: Hormuz corridor statement
• Reliance: FALCON cable system
• U.S. EIA: Hormuz oil flows and alternatives

A browser screenshot documenting failed access to Iran-hosted websites during the blackout on 13 January 2026. It records an earlier shutdown and is not evidence of an October 2026 outage. Credit: Mfgy (screenshot); Chromium Authors (software license). Image source · 3-clause BSD license for Chromium screenshot material, as stated on the Commons file page