Skip to main content

Inside the Cyberwar for Iran’s Future

Armed with mobile phones and the Internet, trusted networks of family and friends spread the news of electoral fraud and escalating tensions in Iran, transfixing the world with photos and videos of demonstrations against the regime.

On Friday, June 12, Iran voted. On Monday, June 15, Tehran erupted. In the face of fast ballot counting that credited high levels of electoral support to Mahmoud Ahmadinejad in the dense urban centers and Azeri communities known to back opposition candidate Mir Hossein Mousavi, the country exploded in demonstrations and violence. Over the next few days, Tehran and other major urban centers saw the largest street protests and rioting since the 1979 revolution.

Domestic politics has often interfered in the administration of elections in Iran, where even competing at the ballot box requires the blessing of the ruling circle of mullahs. The 2005 presidential election that brought Ahmadinejad to power also had irregularities and media blackouts. But this time, civil society groups, social movement leaders and disaffected young people had access to an information infrastructure largely independent of the state. Armed with mobile phones and the Internet, trusted networks of family and friends spread the news of electoral fraud and escalating tensions. That news drew protesters to rooftops and transfixed the world with real-time photos and videos of demonstrations against the regime.


New information and communication technologies have had clear roles in starting new democratic processes in some countries and in entrenching them in others. Activists in Indonesia effectively used mobile phones to mobilize to topple Suharto in 1998. During Kyrghyzstan's Tulip Revolution of March 2005, mobile phones were again used to organize activists to join protests at key moments, helping democratic leaders build a social movement with sufficient clout to oust the president. Kuwait's women's suffrage movement was much more successful in 2005 than it had been in 2000 because it was able to use text messaging to call young protesters out of school. In Egypt, Tunisia and Kazakhstan, opposition groups that face state censorship simply move their online content to servers in other countries. Recent elections in Turkey and Malaysia have demonstrated that blogs have a role in entrenching democratic institutions; challenger candidates who blogged on the campaign trail tended to prevail over incumbents who did not run information-rich campaigns.

Civil society in Iran is incredibly wired. Estimates of the number of blogs in Iran range from 40,000 to 700,000. Even the Revolutionary Guard has developed a strategy to generate 10,000 blogs (though the Basij militias have not proven up to this particular task). The Bureau for the Development of Religious Web Logs offers blogging workshops to Iran's clerics. During the protests, even the most apolitical bloggers covered the demonstrations, and traffic at the dominant blogs swelled.

There is one mobile phone for every two people in Iran, and in urban areas, the vast majority of residents have a mobile phone. There are more than 80 Internet service providers operating throughout the country. Young people — a relatively large segment of the country's population — are particularly sophisticated with digital technologies.

So, if the country has one of the world's most vibrant social media communities in the Muslim world, why, then, has the digital revolution in Iran not had the type of clear political outcomes or institutional consequences seen in other authoritarian regimes? In part, the answer is that new information technologies are helpful to journalists and civil society groups but are not sufficient to cause regime change. Another part of the answer is obvious but often overlooked: The government can blog, too.

In recent years, Iranians have come to expect their political candidates to be online; candidates without a Web presence simply do not appear modern. Candidates usually avail themselves of more than just Web sites, however. Ahmadinejad's campaign blog kept his supporters up to date, responded to political spin and took donations in support of his campaign ( Mousavi's use of digital campaign tools was a strategic response to his exclusion from coverage by state-run television and newspapers. He used Facebook ( to reach out to voters, alert them of his public appearances and help them build a sense of community. Iran watchers have noted that women were particularly active in civic discourse, engaging in political conversations at new levels and in ways rarely seen in offline public interaction.

The Persian diaspora has long been able to express its interests through broadcast media based in London and Los Angeles, but social networking applications have allowed even small enclaves to create content and reconnect with friends and family in Iran. Within Iran, clerics such as Mohammad Ali Abtahi used Facebook to help organize supporters and host political debates.
Facebook was blocked by Iranian authorities soon after it went live in 2004. In a move it probably regrets, however, Iran's Council for Determining Instances of Filtering allowed site access early in 2009 and young Iranians took to it quickly. They reconnected with cousins overseas, and they used Facebook applications to socialize with friends living down the street. Opposition campaign managers in Iran consistently say that such Internet applications allow them to get messages out as never before and thereby organize bigger and bigger campaign rallies. Without access to broadcast media, savvy opposition campaigners turned social media applications like Facebook from minor pop-culture fads into a major tool of political communication.

Several days before election day, a group of employees from Iran's Interior Ministry issued an open letter revealing that they had been authorized to change votes. These days, "open" means distributed by e-mail and hosted on Web sites both inside and outside the country. So the ministry's office of internal affairs was unable to recover the leaked documents. In response, former President Rafsanjani developed a plan for ad hoc exit polling by mobile phones. But the government had a counter-plan.

Text-messaging traffic surged on the eve of the election, but in the early morning hours before the polls opened on June 12, the short message systems went dark, and many mobile phone subscribers found service disrupted. Key opposition Web sites also went offline, including those of the two highest-profile opposition candidates, Mousavi and Mehdi Karroubi. Whereas foreign news sources, such as the BBC Web site, are usually blocked from access within Iran, the list of blocked sites grew significantly that morning. The government began jamming the frequencies of Farsi-language satellite broadcasts from the BBC and Voice of America as well.

Late in the day, government officials declared that Ahmadinejad had defeated his more moderate challenger, triggering massive street protests by Iranians who doubted — or did not like — this outcome. For many, the vote tabulation seemed implausibly fast.

People took to the streets of Tehran and Esfahan immediately. There was a flood of digital content from the Iranian street: photos, videos, blog posts, tweets and SMS messages flowed between protesters and out to the international community. According to The Wall Street Journal, while this content was flowing, the government closely inspected digital traffic to try to identify social movement leaders. To regain the upper hand in political communication, the government-run Data Communication of Iran disabled Internet access for 45 minutes late in the afternoon on the 13th to initialize its "deep packet" inspection system. My own research contacts reported that the process of inspecting the traffic choked bandwidth to the rest of the world, such that Iran was effectively off the global grid for almost 20 hours between Saturday night and midday Sunday.

To support network communications, the Iranian opposition organized a supply of proxy servers unknown to government censors and coordinated attacks on pro-Ahmadinejad Web sites and state media portals. Free online tools provided encryption, anonymizers and secure communication networks. Despite government interference with digital services, SMS, Twitter and other social media were used to coordinate massive turnout at protests across the country for Monday, June 15.

By then, the cyberwar was also well under way. The attacks were launched not only by a few university students well versed in the dark arts of hacking but by an army of amateurs eager to learn the few basic skills that would collectively overwhelm the government information systems. Parts of the information infrastructure of major government agencies were rendered unusable, from the ministries of Justice and Foreign Affairs to the official Web sites of the police and Supreme Ruler Sayyid Ali Khamenei.

A few days into the protests, the international community of tech-savvy digerati also began working to disable the government's information infrastructure and support social movement leaders. Volunteers around the world contributed by turning their home computers into proxy servers for users based in Iran, allowing them to bypass the government's censorship efforts. Pro-democracy activists on the Web traded notes on how amateurs could launch denial-of-service attacks on government servers and suggested which targets would be most important. Within Iran, bloggers learned how to get their content around government censors. Tip sheets offered helpful links on how to use Twitter securely and effectively.

Both Facebook and Twitter were used by many young people for street-level communications during the protests. On June 16, the U.S. State Department asked Twitter to delay a network upgrade that would have shut down service for a brief period during daylight hours in Tehran. More than 90 percent of Twitter users in Iran live in Tehran, and 25 percent of the current Iranian user base created accounts during the last three months of political campaigning. State Department spokesman Ian Kelly rejected the accusation that by meddling with the development of Iran's information infrastructure, the Obama administration was taking sides in Iran's disputed elections. "This is about giving their voices a chance to be heard. One of the ways that their voices are heard [is] through new media," he told reporters.

Twitter was used to help street protesters find safe hospitals where injuries could be treated without drawing the attention of Basij militias. As these militias moved through neighborhoods and gunshots were heard, alerts went out. When intelligence agents raided an apartment or took a family member, the incident was shared with family and friends. Protest leaders also used Twitter to recruit more international cyber-activsts.

Barely a week after the protest marches had begun, Google fast-tracked the development of a Farsi-language translator, and Facebook rushed out a beta translation of its content into Farsi. Both companies were hoping to serve the Persian — and global — online audience eager to communicate about events in Iran.

On June 20, Neda Agha-Soltan was shot dead at a demonstration, and her death was caught on a mobile phone camera. Just as in-country protests were cooling, the mobile phone video of her blood pooling on the street was uploaded to YouTube. Her death, digitally captured and distributed over the Internet, became one of the iconic global images of the protest, turning her into a martyr who inspired (and rekindled) protests 40 days later.

Twitter user persiankiwi had 24,000 followers by day six of the protests. Mousavil1388 was engaging 7,000 followers. #StopAhmadi kept more than 6,000 followers alert to photos uploaded to Flickr. The Twitter service itself was registering 30 new posts a minute with the #IranElection identifier. Specialty Persian news channels in Los Angeles received hundreds of digital videos daily, and YouTube became the repository for the digitally captured, lived experiences of the chaotic streets of Tehran. #CNNfail let the global audience gripe about CNN's paltry coverage of the political clashes in Iran. Between June 7 and June 26, an estimated 480,000 Twitter users exchanged more than 2 million tweets, with Twitter streams peaking on election day at more than 200,000 per hour.

Digital media sustained protests well beyond what pundits expected. Indeed, this new information infrastructure gave social-movement leaders the capacity not only to reach out to sympathetic audiences overseas but also to reach two important domestic constituencies: rural, conservative voters who had few connections to the urban chaos, and the clerical establishment. The unprecedented activation of weak social ties brought the concerns of disaffected youth, cheated voters and beaten protesters to the attention of the mullahs. The result was a split within the ruling establishment on how to deal with the insurgency, how to proceed with counting ballots and how to credibly authorize Ahmadinejad to take power.

In some ways, the regime's response to the digitally empowered insurrection was decidedly old media: expelling foreign correspondents, blocking phone lines, preventing the publication of daily newspapers and accusing enemy governments of spreading misinformation. The regime did not count on the large number of Iranians eager to submit their own content to international news agencies, and, perhaps more important, it did not realize that large numbers of Iranians would use social media to share their own personal stories of beatings, tear gas inhalation and protest euphoria with one another.

But the government was not ignorant of the reach of new media. Almost as quickly as protesters took to Twitter and Facebook, the government's security apparatus began using these applications to spread disinformation. Web sites run by the Basij collected digital video and photos of protesters and asked Iranians online to help identify particular protesters. And to the surprise of many technorati, it became apparent that the Iranian government had built a single choke point for traffic to the rest of the Internet and a deep-packet inspection system that would slow traffic to allow for content analysis. Most countries have such monitoring centers, but their use is governed by some public policy guidance designed to identify the lawful circumstances for intercepting traffic. Once built, however, the owners of such equipment get to decide what those circumstances are. In Iran, the regime had carte blanche to set the keywords that alerted authorities about who was communicating what over the nation's digital infrastructure.

And the Iranian government continues to take the threat of the digital revolution seriously. On election day, Mousavi had 10,000 Facebook fans. A month later, he had 10 times that number and a genuinely global campaign. In July, the Iranian Parliament began debate on a measure to add Web sites and blogs promoting "corruption, prostitution and apostasy" to the list of crimes punishable by death. Security officials have detained the Webmasters of reformist Web sites and shut down servers. Several high-profile bloggers remain in prison.

Overall, it is not clear that international cyber-activists had more than a symbolic effect on the infrastructure of the Iranian government. It may, in fact, have been in the interests of the ruling mullahs to have opposition venting online, rather than exhibiting some other form of political resistance. Many of the tools for causing troubles for government servers, such as BWRaep, also had an effect on the bandwidth available to other users in Iran.

Millions of people took to the streets in the week after the election results were announced and certainly not all were using Twitter. The majority of them, however, were responding to both strong and weak network ties and to the digital technologies designed to maintain those ties. Even with the blackout on domestic broadcast media and censorship of digital traffic, the regime's political opponents were able to circumvent the state's choke hold on information. And with few reporters on the ground, Western news agencies used the "technology revolution" as an easy peg for coverage.

So what does the digitally fed Iranian near-revolution mean for the future of Middle East governance?

In the wake of the Iran protests, it's become clear that Middle East elections — even rigged ones — are increasingly open to becoming moments of political crisis. The ruling elites in many countries have managed development, politics and communications for decades. What has radically changed in just the last five years is the infrastructure of political communication, which the elites can monitor but not completely control.

At key moments in a political crisis, it is possible for the state to disrupt the supply of newsprint and ink or shut down the broadcast towers of radio and television stations. It is much more challenging for governments to disable networked information infrastructures. Cutting the power to some Internet service providers or mobile phone towers often means that information packets flow to other network nodes. Network traffic in and out of a country can sometimes be stopped by disabling the Internet exchange points in port cities, but doing so can have broader consequences for the national economy, constraining the capacity of the state itself. Regimes that deliberately create choke points in their packet-switching infrastructure are better able to censor, but such points are themselves a security risk for the regime. In Iran's case, the ruling elites tried to constitute an information infrastructure that could be closely managed in times of crisis. Clearly, though, their efforts were, at best, incompletely effective.

Street protests are the result of and a conduit for collective effervescence, a rare spirit of energy that grips people hungry for change. In contemporary systems of political communication, citizens turn to the Internet as a source of information that can feed such effervescence. It is not only that online social networking services are influential as communications media; rather, they are now also a fundamental infrastructure for social movements. And the Internet globalizes local struggles. Authoritarian regimes always conduct propaganda battles over broadcast media. But what is the regime countermeasure for the chilling effects of a plea from someone in your social network who has been a victim of police brutality?

Cyber-activism is no longer the unique provenance of isolated, politically motivated hackers. It is instead deeply integrated with contemporary social movement strategy and accessible to computer and mobile phone users with only basic skills. It is a distinguishing feature of modern political communication and a means of creating the élan that marks social change.

Information and communication technologies are the infrastructure for transposing democratic ideals from community to community. It does not matter that the number of bloggers, twitterers or Internet users may seem small, because in a networked social moment, only a few "brokers" need to be using these tools to keep everyone up to date. These are the communication tools for the wealthy, urban and educated elites whose loyalties or defection will make or break authoritarian rule. Twitter communities have leaders and followers, and those communities supply information, misinformation and disinformation. (Iran's supreme mullah, Ayatollah Khamenei, did not shave his head and attempt to flee, as one Twitter user claimed.) During the protests, the top 10 percent of users generated more than 65 percent of the tweets.

It would be a mistake to tie any theory of social change to a particular piece of software. In the summer of 2009, the Iranian insurgency was shaped by multiple digital communication tools. These Internet-based tools gave the social movement access to the clerical establishment through weak ties of social networks that connected mullahs to Iranians on the street. Social movement scholars write that elite defection usually marks the end of an authoritarian regime. In Iran in 2009, technological social networking reached elites — but not enough of them defected to cause the government to fall.

So was the lack of democratic transition a technological or social failing?

In important ways, Iran's postelection insurgency was almost an example of a digital revolution. It is unlikely that protests would have lasted as long, raised so much international support and had such an impact on domestic politics had it not been for mobile phones and the Internet. The Internet did not cause the insurgency, but it is probably a truism to say that no contemporary democratic revolution in the Middle East will happen in our times without the Internet. As one ethnic Azeri blogger told me, the regime has learned that the Internet makes collective action possible.

Technology does not cause political change — it did not in Iran's case — but it does impose new constraints on political actors. New information technologies do not necessarily topple dictators; they can catch dictators off guard. Because of the rise of Iranian social media, the world saw interest in change expressed from within Iran, and this may prove to be the most destabilizing outcome of last summer's street protests. The mullahs are no longer so politically unified. The regime's brutalities streamed around the globe. The world saw the dissent; the regime knows the world saw the dissent.

Last summer we learned that Islamic democracies will likely be born digital, rather than growing out of some stage of proto-democracy, as in Latin America. Iran's street protests failed to topple the government. But the world's most technologically advanced censors failed to manage the government's election crisis, leaving the region's dictators with a continuing concern: their own tech-savvy, disaffected youth.

Sign up for our free e-newsletter.

Are you on Facebook? Become our fan.

Follow us on Twitter.

Add our news to your site.