Skip to content
You can now search across every topic, entity and event.What's new
DFRLab
OrganisationUS

DFRLab

Atlantic Council's digital-forensics lab; tracks online disinformation, information operations, and internet shutdowns.

Last refreshed: 9 May 2026 · Appears in 1 active topic

Key Question

How is DFRLab documenting Iran's two-tier internet during the conflict?

Timeline for DFRLab

View full timeline →
Follow Iran Conflict 2026 →
Common Questions
What is DFRLab and who funds it?
DFRLab is The Atlantic Council's Digital Forensic Research Lab, founded in 2016. It is funded by a mix of government grants, foundations, and private donors, and investigates disinformation and digital authoritarianism.Source: Atlantic Council
What is Iran's white internet system?
Iran's tiered 'white' internet, operationalised by the Supreme National Security Council in May 2026, provides full access to regime-approved institutions while degrading connectivity for the general population. DFRLab and NetBlocks documented its rollout.Source: DFRLab / NetBlocks
How does DFRLab investigate internet shutdowns?
DFRLab combines open-source intelligence (OSINT) techniques, network traffic analysis, and geolocation data to document and attribute internet disruptions, often in coordination with NetBlocks and IODA.Source: DFRLab

Background

The Digital Forensic Research Lab (DFRLab) is a nonpartisan research initiative of the Atlantic Council think-tank, founded in 2016. Based in Washington DC with research teams across Europe, Latin America, and Asia, DFRLab investigates disinformation, influence operations, and digital authoritarianism. It publishes open-source investigations into state-sponsored information warfare and maintains monitoring of internet freedom conditions in conflict zones.

In the Iran conflict context, DFRLab became a primary source for tracking Iran's tiered internet system, which the Supreme National Security Council operationalised in May 2026 to create a two-tier "white" internet for regime-approved institutions while degrading access for the general population. DFRLab's work on Iran's information-control architecture, in combination with reporting by NetBlocks (led by Alp Toker), provided quantitative and qualitative data on the shutdown's scope and targeting.

DFRLab has previously documented Iranian influence operations targeting US elections and Middle Eastern audiences, making it a natural institutional voice on the regime's information-warfare capabilities during the conflict.