UnlockedA Psiphon Blog
RESEARCH

Ensure Security & Continuity, Research & Innovation Aren't Optional

9/25/2025 - 1 min read

In an age where Internet connectivity is increasingly vulnerable to disruption, staying ahead of security, continuity and censorship challenges requires relentless innovation. The dynamic nature of modern blocking techniques, from deep packet inspection to AI-driven filtering, means that yesterday’s circumvention methods often fail under today’s scrutiny. And as these technologies are increasingly shared, your business needs a way to stay connected. That’s why Psiphon Forge’s partnerships with leading academic and technical research communities are not just strategic—they’re foundational. Innovations like complex multiprotocol adaptivity and AI-based machine learning evasion techniques have been brought to scale through these collaborations, and are already deployed across Psiphon’s global infrastructure to counter emerging threats in real time.

These research alliances also fuel Psiphon Forge’s edge in observability and adaptation. By analyzing over 100 million connections per day, our network continually refines its ability to detect, respond to, and bypass censorship events as they unfold. This intelligence directly informs product updates, protocol optimizations, and the tuning of our SDK for minimal overhead and maximum performance. For businesses integrating Forge—whether in secure messaging, logistics, or media delivery—this means continuity in the face of shifting digital ground. In fragile and censored environments, our commitment to research isn’t optional; it’s what makes Forge the world’s most adaptive and dependable embedded resilience platform.

ResearchForge

Up next

The New Normal for the Iranian People: Population-scale Response to State-Level Communication Disruption

5/15/2018 - 16 min read

In December 2017-January 2018, protests erupted throughout Iran, calling for change in the country. Unlike the protests of 2009, known as the Green Revolution, this civil unrest involved many Iranians that previously were unaffiliated with any political opposition movement. In response, the Iranian government enacted blocks on Telegram and Instagram in the country. To gain access to these applications and circumvent censorship, Iranian users flooded to tools like Psiphon. In order to shed light on these protests and the resulting surge in users, Psiphon has collected and analyzed network data from before, during and after the protests. This data has been combined with an understanding of the political, social and economic situation in Iran for a deeper look at how Internet connectivity and freedom impacts Iranian society as a whole. Ultimately, this blocking event has proven the importance of the Internet and access in Iran and highlighted the growing technical abilities and scope of the Iranian censorship regime.


Key Observations

 On December 28, 2017, protests broke out in the northeastern city of Mashhad; smaller protests also occured in the nearby cities of Neyshabour and Kashmar. Initially calling for solutions to economic grievances, protests eventually covered social issues such as corruption, the presidency of Hassan Rouhani and Iran’s involvement in foreign conflicts. Some protestors even directly criticized Supreme Leader Ali Khamenei. Over the following days, the movement spread across Iran, with protests in nearly every single province. Protests occurred in many smaller cities and included many Iranians not officially or previously affiliated with any organized opposition group. Additionally, protests occurred daily in the capital of Tehran until January 9, 2018.

In response to the nationwide demonstrations, the Iranian government and the Islamic Revolutionary Guard Corps (IRGC) responded with force, both physically and virtually. However, due to the fact that this was a largely rural movement, it is possible that IRGC forces found it harder to physically limit the protests and the Iranian government turned to Internet and application blockages to quell the movement. Still, a number of protesters were arrested and, in some cities, tear gas, water cannons and other tactics were used to break up demonstrations.12 Three days into the protests, on December 31, the Iranian government blocked access to both Telegram and Instagram, the country’s most popular messaging and social media platforms, respectively. Thanks to Psiphon and other censorship circumvention technologies, Iranians were able to connect and maintain information sharing across these sites.


Reasons behind the protests





Despite some of the optimism stemming from easing of economic sanctions, Iranians were overburdened by economic hardship in 2017. Though Iran’s oil and gas industry has grown considerably in the last year, with production rising 62%, economic relief has not as quickly expanded to other sectors of the economy, which has only seen a growth of about 3.3%.3 Unemployment rose from 12.4% to 12.6% from January to July 2017 and continues to hover around 12%.4

In a survey of Iranian activists conducted by the link-sharing platform Balatarin, individuals indicated that economic issues and corruption were the leading causes behind the protests. In addition, rising inflation and the cost of living proved to be the most significant priority for Iranian families, followed by citizens’ rights. These concerns were reflected in the calls of protesters: "If embezzlement decreases, then our problems will be solved!”, "Come out fellow countrymen, scream and shout for your rights!", and “The youth are unemployed [while] the mullahs sit behind a desk!”5. 



In early December, President Rouhani released his version of the budget, promising alleviation of economic pressures, including rising employment and inflation. This relatively conservative budget went to the Majlis for approval on December 14. During the month of December, a substantial increase in social media usage by Iranians was seen on the Psiphon network leading up to the protests. On December 19, usage tripled, from an average of 2 terabytes (TB) to 6TB. On December 30, usage tripled again, hitting 18TB. It is possible that this build up was indicative of the unrest to come, as more Iranians moved to social media to express their grievances, before ultimately taking to the streets.



 The censorship regime in Iran

Censorship of online content inside Iran is institutionalized at the highest levels of government. In March 2012, Iran’s Supreme Leader, Ayatollah Ali Khamenei, authorized the creation of the Supreme Council of Cyberspace (SCC), which is comprised of 17 members from various government institutions plus an additional 10 members appointed by Khamenei himself. It has become the central agency for implementing and upholding policies pertaining to the censorship of online content inside Iran.7 At its inception, Khamenei asked then-President Ahmadinejad to chair the Council8, though 2015 reforms resulted in the transfer of authority to the Supreme Leader9 and the consolidation of decision-making authorities of the pre-existing High Council of Informatics, Supreme Council of Information, and Supreme National Security Council of Information Exchange (AFTA) under the sole jurisdiction of the SCC.10

All Iranian internet service providers (ISPs) function under the jurisdiction of the Communication Regulatory Authority of Iran (CRA), which is responsible for telecommunications licensing and enforces censorship policies outlined by the the Committee for Determining Offensive Contents under the powers of the executive. It oversees the implementation the technical censorship policies that support the initiatives of the SCC. Such actions include:




  • The limitation of private home user bandwidth to 128 kilobytes per second (kb/s).
  • The redirection of Domain Name Service (DNS) queries, causing certain DNS requests to respond with fake local IP addresses that act as black holes to drop traffic intended for blocked domains.
  • The inspection of internet packet headers and URLs for keywords that may lead to sites with content that may feasibly be deemed immoral or could cause political or economic turmoil, and the manipulation of such traffic.
  • Especially during periods of political and economic unrest, ISPs will limit speed (aka throttle), either to specific sites or internet communication protocols, or all traffic.11
  • The government counterfeiting of web certificates to popular sites in order to conduct man-in-the-middle attacks.12
    • Traditional censorship practices have already been installed throughout the Iranian network. Website owners are required to register with the Ministry of Culture and Islamic Guidance or risk being blocked.  Website owners and private citizens that post potentially inflammatory content receive official removal requests. The Iranian Revolutionary Guard Corps routinely arrests Telegram channel administrators to coerce them into removing content or delete channels entirely. News sites are sent warnings about how they should report on controversial topics, such as the Nuclear Deal. All of these practices lead to significant self-censorship in order to avoid arrest.13 And censorship capabilities have become more pervasive in recent year, as the CRA has implemented policies to diversify and expand telecommunications networks throughout Iran.

    Censors’ response to the protests





    On December 30, Iran’s Minister of Information and Communications Technology Mohammad-Javad Azari Jahromi tweeted a request for the removal of @amadnews, a Telegram channel, to Telegram founder Pavel Durov. Telegram complied, removing the channel for its use of violent language. It is important to note that Twitter is a blocked platform in Iran, though Jahromi has requested that Twitter be made available to all Iranians. It is not uncommon for Iranian officials to use this banned social media platform, however it is particularly interesting that, in this case, it was used to publicly communicate removal requests for content on a popular application that has been heavily monitored, though still permitted, by the government. Telegram refused to comply with further content removal requests, explaining that the channels were, in fact, merely using the platform for peaceful protest. Because of this, the Iranian government directed Iranian ISPs to block traffic to the Telegram app and web interface on December 31.14 On the same day, Instagram, a popular picture and video sharing application, was also blocked. The block on Instagram lasted until January 6, while the Telegram block lasted until January 13.

    During this time, Iranians continued to protests and access these platforms and others through circumvention software. This is evidenced by both continued, and even increased, engagement on both platforms. Though a brief drop in usage occurred initially, data shows that the number of posts and views on Telegram in Iran quickly returned to the about the same levels as before the blocking event. On Instagram, users flocked to Persian language news and media accounts. BBC Persian continued to call for videos and photos of the protests through its Instagram account and Telegram channel, despite both platforms being blocked by the government. In fact, BBC Persian’s Instagram following grew by about 200,000 in less than two weeks; one week of which Instagram was blocked in Iran. It had previously taken the account about nine months to gain that same amount of followers. A similar phenomenon occurred on the Instagram accounts of Radio Farda and Voice of America-Persian News Network (VOA-PNN).



    Iranian user behavior and analytics

    Psiphon has worked to offer users multiple ways of using our software, whether for mobile or desktop use. There are three major platforms through which one can download Psiphon: Google Play store, the Apple App Store, and through email auto-responders. On January 1, downloads peaked with:
    • 766,235 via Google Play
    • 458,768 via the App Store
    • 82,280 via auto-responders
    Psiphon has dedicated email auto-responders for specific clients. On December 31, BBC Persian took to Instagram and posted a warning to all Persian speaking followers, instructing them on how to download Psiphon via their email auto-responder. On that day, BBC Persian, normally responsible for about 60 Psiphon downloads per day, was responsible for 60,695 Psiphon downloads. This is just one example of the many important relationships that are required to ensure internet access to people all over the world.

    Google Play showed Psiphon as the most downloaded app in Iran during the protest, with competing tools rising and falling in the rankings as they proved ineffective for users. Applications for other circumvention tools, like VPNs and Lantern, a peer-to-peer software used for censorship bypass, rose and fell on the charts as users found that connections made through these apps were unreliable or slow, as expressed on Twitter. Psiphon remained the number one app in Iran on Google Play for over two weeks. Not only did Psiphon see a consistent increase in users, but this increase was at a much larger scale than other tools. Tor analytics showed a similar trend of increased use, with a spike during the protests. However, this increase peaked at just under 12,500 daily connections, while Psiphon’s network supported 287,925,106 connections on January 2 alone.15

    Not only were new users downloading the app, but network analytics show that they were actively using it. Over the course of the protests, Psiphon added 22.2 million new users to the network. Data transfer during the protest period hit 61 megabytes (MB) per user per day at its lowest point. Emergency network scaling allowed for the Psiphon network to transfer and average of 124MB per user per day. As a point of reference, if an American paying $35 per month for a 2 gigabyte (GB) monthly plan through Verizon were to spread their data usage out equally throughout the month, they would be able to use a maximum of 66MB per day. Additionally, the global average mobile data plan is 4GB monthly, translating to 133 MB per day. During the entire protest period, our network transferred 19.54 petabytes (PB), equivalent to the amount of data processed by Google all over the world each day. Psiphon saw a peak data transfer on January 9 of of 1.445PB, which is equal to the same data as all of the 10 billion photos on Facebook.



    All in all, a massive amount of data was transferred over the Psiphon network in response to the protests and blocking. The success and scalability of the Psiphon network during peak blocking periods can be credited to its heterogeneous infrastructure, varied partnerships, and significant focus on innovative research and development. By incorporating circumvention protocols such as Refraction Networking and MEEK, Psiphon’s network had become more redundant, resilient, and has increased its surge capacity.







    Psiphon’s “new normal” in Iran



    Psiphon has now adapted to a “new normal” in Iran. Part of this new normal is the significant increase in the amount of data being transferred over Psiphon’s network to social media platforms alone. This can be seen in the graph on the left, which shows that, on average, over 16TB of social media traffic is being transferred over the Psiphon network. This includes major platforms such as Facebook, Twitter, and Instagram.

    The prevalence of the Iranian video sharing service Aparat on this graph, especially over Youtube, may be indicative of future threats to internet freedom in Iran. In order to post on Aparat, users need to connect their real identities with a registered account. This is part of the Iranian government’s larger initiative to produce a “halal net,” formally called the National Information Network (NIN).

    This new normal also includes potential disruptions, both technical and political, that Iranian users face. In the first few days of February, Iranians took to the streets again in a number of strikes and protests against months of unpaid wages by their employers. These strikes spanned various industries, including bus drivers and railway workers. This activity was reflected on Psiphon’s network with a surge of users on February 5, from 3 million average daily unique users to 4 million. In times of political unrest, Psiphon has become the go-to censorship evasion tool for many Iranians.




    This is also true for disruptions of a technical nature. On February 20, users in the Middle East and Europe became unable to access Telegram. On that day, the Psiphon network saw a significant surge in traffic from Iran, with over 3 million connections made. Suspecting a censorship event, Iranians users flooded to Psiphon to test the connection to Telegram. Through Psiphon, they were able to determine that there was a technical error in Telegram’s service, rather than a blocking event by the Iranian government. These incidents show that Psiphon is a trusted tool when internet accessibility is not guaranteed.

    The continued Telegram battle

     Telegram has continued to be a target for the Iranian regime and the government has moved to permanently block Telegram. On April 30, after the app’s use by government officials was prohibited, the Iranian judiciary issued a court order for all Iranian ISPs to begin blocking Telegram, effective immediately.16 Iranians have been encouraged to use domestic communication applications, which are generally avoided as they are widely-known to be subject to tight government control and surveillance. On May 7, six lawyers filed a petition to the Court for Government Employees in Iran to end the ban on Telegram in an unprecedented use of legal action against the Iranian government.

    On April 26, Psiphon was contacted by the developers of TelegramDR with a request for assistance integrating and supplying network traffic for the Telegram Digital Resistance app. In anticipation of the long-threatened blocking of Telegram, Psiphon developers and outreach team members worked to successfully meet the April 30 deadline and offer Iranian citizens an effective tool for secure communication. On May 1, in direct response to the blocking event, TelegramDR was released on Google Play. Since the release, over 700,000 Iranians depend on TelegramDR, pushing over 5TB of traffic per day, indicating that the intensification of internet service blocking will surely be met with innovative circumvention techniques.

    Conclusion

         Since the Green Revolution of 2009, web and mobile online penetration of Iranian citizens has climbed dramatically. In fact, it has more than doubled. As of 2016, internet users make up over half of the Iranian population; in 2009, this was just under 14%.17 Access to the internet has become more widespread and quality has greatly improved. With this comes a greater reliance on internet-based platforms by Iranians, for everything from financial services to business operations. In addition, the influence of social media in the country has rapidly grown. Many businesses and news organizations rely on social media to connect with their customers. In addition, social media is slowly becoming the preferred method of communication among Iranians. This has been seen on the Psiphon network with more bytes transferred to social media sites than ever before. As stated previously, from the period before the protests and the blocking event to the end of the protests, Psiphon gained 22.2 million new users. This has led to an increase of one million average daily users; prior to the blocking Psiphon on average supported two million users per day in Iran and now supports about three million users per day.


    Psiphon continues to operate at this new normal and must be prepared to increase capacity further in the event of another blocking event. However, there are considerable operating costs associated for any circumvention tool. In order to provide reliable connections to users in Iran, circumvention tools, like Psiphon, need consistent support. In addition, without access to these tools, Iranians may be compelled to migrate to government-supported and controlled domestic social media platforms. In order to maintain support for internet freedom, existing program models and support may require re-engineering. This would ideally include broader support from major social media platforms as their content is being delivered by much smaller, less funded organizations. In addition, more investments in technologies that can deliver content, expand the range of services, provide augmented capacity and adaptation will be necessary. As the Iranian government devotes resources to the development of its NIN, the internet freedom community will need to continually improve and build its capabilities.
    --
    By: Ariel Leuthard and Jacob Klein

    1 “More Students Arrested in Iran as Protests Continue,” Radio Farda, January 2, 2018.
    2 Associated Press, “At least 9 killed in Iran overnight as protesters, security forces clash,” retrieved from Politico, January 2, 2018.
    3 “Iran’s Economic Outlook,” The World Bank, October 11, 2017.
    4 “Iran’s Economic Outlook,” The World Bank, October 11, 2017. 
    5 Saidi, Mike, “Iranian Anti-Regime Protests and Security Flaws: A Dataset,” Critical Threats Project, American Enterprise Institute, January 12, 2018.
    6 “Iran’s Rouhani submits conservative 2018 budget as US tensions overshadow economy,” Reuters, December 10, 2017.
    7 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.
    8 “Iran’s supreme leader calls for new internet oversight committee,” Los Angeles Times, March 7, 2012.
    9 “Khamenei consolidates power over Internet policy in hardline council he controls,” Center for Human Rights in Iran, September 14, 2015.
    https://www.iranhumanrights.org/2015/09/khamenei-internet-policy-iran/
    10  “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.
    11 This has been reported for connections to Google services such as Gmail as well as traffic via specific protocols including HTTPS, SSH and VPN tunnels.
    12 Simurgh Aryan, Homa Aryan, and J. Alex Halderman, “Internet Censorship in Iran: A First Look,”, Presented as part of the 3rd USENIX Workshop on Free and Open Communications on the Internet,” 2013.
    13 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.
    14 Durov, Pavel, Telegram post, December 31, 2017.
    15 “Directly connecting users from Iran,” Tor Project, accessed February 2018. 
    16 Parisa Hafezi, “Iran’s judiciary bans use of Telegram messaging app: state TV,” Reuters, April 30, 2018.
    17 World Bank, “World Development Indicators Dataset: Iran,” retrieved March 2018. 


    ResearchIranPsiphon VPN