From Blackout to Whitelist: The Anatomy of a Tiered Internet

When Iranian diplomats were busy posting viral memes, millions of regular Iranians had no internet access at all. This was not a glitch; it was the result of a carefully built system called the National Information Network (NIN). This network is designed to separate Iran’s local internet from the rest of the world. In the past, Iran tried to block specific foreign websites one by one, which is known as a “blacklist”. Now, they have switched to a “whitelist” model. By using databases like SHAHKAR and HAMTA to track people’s IDs and devices, the government can easily cut off the global web for the public while giving special access to a chosen group of approved users. This setup is exactly how the state plunges millions into digital darkness while making sure its most loyal voices stay perfectly online.

The Infrastructure Behind Selective Access

The persistence of account activity during nationwide shutdown periods cannot be understood without examining the infrastructure that enables differentiated access inside Iran’s network environment.

At the center of this architecture stands the National Information Network (NIN), a domestic routing framework designed to separate internal service availability from international connectivity conditions. By maintaining independent control over domestic traffic flows while regulating access to international gateways, this structure enables authorities to selectively restrict external access for different groups of users without disabling internal services.

Network-level measurements collected during the January shutdown illustrate this structure clearly. While indicators based on user activity, search traffic, and telemetry signals showed sharp declines consistent with widespread access disruption, Border Gateway Protocol routing visibility remained largely unchanged. This pattern is consistent with selective filtering rather than the physical disconnection of international infrastructure.

Selective connectivity at the user level operates in parallel with these routing controls. Identity-linked subscriber databases such as SHAHKAR, which connect national identification numbers to SIM registration records, together with device registries such as HAMTA, create the technical conditions necessary for assigning differentiated access permissions across the subscriber base and implementing tiered access policies at a national scale.

Taken together, these systems enable the implementation of tiered connectivity policies in which international access can be preserved for selected users while restricted for the broader population.

Evidence from posting continuity across the dataset suggests that during shutdown periods, this architecture supported a distributed communication layer rather than a narrow channel reserved exclusively for senior officials or emergency coordination purposes. Instead, it functioned as part of a structured approach to maintaining narrative presence online during periods of restricted public connectivity.

From Blacklists to a Whitelist Architecture

For more than a decade, internet filtering in Iran relied primarily on a blacklist model in which selected foreign platforms and domains were blocked while the rest of the network remained reachable. Over time, however, the development of the National Information Network created the technical conditions for a transition toward a more granular connectivity control model based on selective access rather than selective blocking. This transition reflects not only a technical evolution but a shift in the operational logic of nationwide shutdown enforcement.

This shift made it possible to regulate international connectivity without disabling domestic services. Instead of removing access to specific platforms individually, authorities gained the ability to determine which users, sectors, and institutions could continue to communicate externally during shutdown periods.

Traffic measurements collected during the 2026 shutdown illustrate this transition clearly. While user-level activity signals declined sharply across the country, routing visibility remained largely unchanged. At the same time, residual international traffic gradually increased during later phases of the shutdown, indicating that access continuity was being preserved for selected users and organizations rather than restored universally.

This pattern is consistent with a whitelist-oriented routing model in which connectivity is progressively reintroduced for prioritized actors rather than reopened across the entire subscriber base.

Evidence from technical documentation circulated within Iran’s network governance apparatus further supports this interpretation. A leaked operational framework describing staged restoration of international connectivity outlines a four-step sequence in which access to external networks is re-enabled only after protocol-level blocking signatures are deployed, national DNS enforcement is activated, and domain-level and prefix-level filtering rules are applied.

The same framework recommends suspending IPv6, UDP, and ICMP traffic during crisis conditions together with activating real-time deep packet inspection monitoring. These measures indicate that tiered connectivity restrictions are implemented as part of a predefined operational doctrine rather than as improvised emergency responses.

Taken together, these developments suggest that the transition from blacklist filtering toward whitelist-oriented routing has fundamentally changed how shutdowns function inside Iran’s network environment. Instead of disconnecting the country from the global internet, authorities now control which segments of the population remain connected during periods of political tension or military escalation.

Internet Pro and the Expansion of Tiered Access

One example of this transition is the introduction of services described domestically as “Internet Pro,” a connectivity program reportedly developed following consultations between digital economy organizations and government officials after the recent shutdown. The program is intended to ensure that selected commercial actors maintain stable international routing during shutdown periods, preserving operational continuity for prioritized economic sectors despite restrictions affecting the broader population. At the time, Factnameh looked at the impact of internet shutdowns on Iran’s economy.

Telecommunications operators began offering these services to approved businesses, technology firms, legal institutions, and selected economic actors in order to preserve operational continuity under conditions of restricted public access. Similar to earlier White SIM–based user-level access policies, Internet Pro extends selective connectivity into the institutional economic domain. This program effectively allows authorities to sustain shutdown conditions for longer periods without imposing full economic paralysis.

The emergence of such programs indicates that tiered connectivity is evolving into a structural feature of network governance rather than a temporary emergency mechanism, extending whitelist-oriented routing from political communication sectors into the economic infrastructure layer.

Earlier policy statements by the former Ministry of ICT leadership had already anticipated this direction. Azari Jahromi publicly argued that different professional groups should receive different levels of internet access depending on their social function. Pilot initiatives at Sharif University tested precisely this type of differentiated routing through controlled IP-based access channels.

Together, these developments demonstrate that selective connectivity is not confined to wartime narrative management. It forms part of a broader effort to institutionalize stratified access across multiple sectors of the networked environment.

Conclusion

The success of this selective internet access is a major warning sign. This system is no longer just a temporary panic button used during wars or protests; it has become a permanent part of how Iran controls its internet. For example, the government has introduced “Internet Pro” packages. These packages give approved businesses, tech companies, and law firms special access to the global internet during national blackouts. This allows the government to keep the internet shut down for the public without completely destroying the economy. Ultimately, Iran has changed what an internet shutdown looks like. Instead of turning the internet off for everyone, the regime uses its technology to carefully choose exactly who gets to speak to the outside world. By doing this, the government ensures that any message coming out of the country during a crisis is tightly controlled.