16JUL

Iran's internet returns at 40%, by design

3 min read

09:32UTC

Iran's internet reached only 40 per cent of pre-war traffic by 28 May, NetBlocks reported, with Chinese-built hardware for a permanent, switchable blackout already installed.

← Back to ASML's tool boom skips Europe's logic gap Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Iran rebuilt its internet around a Chinese-built switch it can flip off at will.

Iran's internet reached only about 40 per cent of pre-war traffic by 28 May, the monitor NetBlocks reported, three days after President Masoud Pezeshkian's 25 May restoration order ended the longest national shutdown on record . ¹ NetBlocks is the UK-based watchdog that measures connectivity disruptions worldwide. In practice most Iranians remain effectively offline, and those who do reconnect stay on virtual private networks, the tools that route traffic abroad to evade state filtering, expecting the next shutdown.

Mohammad Sarafraz, a member of Iran's Supreme Council of Cyberspace, confirmed that Chinese-built deep-packet-inspection hardware for a permanent, switchable blackout has been imported and installed . ² Deep-packet inspection lets the state read and block traffic by content rather than crudely severing the line.

Iranians are back online inside a system that can be cut by a single decision, with the Chinese equipment already wired in. The 40 per cent figure is the visible change; the switchable hardware behind it is the durable one. Iran has compressed the timeline China used in Xinjiang, where a ten-month isolation in 2009 was followed by embedded inspection hardware, installing the architecture during the war rather than after it. The next blackout need not be an emergency dragged out for weeks. It can be a switch, and VPN use stays heavy because ordinary users assume the next cut is a matter of when, not whether. ³

Deep Analysis

In plain English

Iran's government shut off most of its internet on 28 February when the war started. President Pezeshkian ordered it restored on 25 May. Three days later, on 28 May, only about 40% of normal traffic was flowing, according to the monitoring service NetBlocks. Most people are still effectively offline, and those who can connect use VPNs because they expect the government to cut it again. A senior official called Mohammad Sarafraz confirmed that China supplied Iran with hardware that lets the government switch internet access on or off instantly, by region or across the whole country. So the restoration is partial by design, and the hardware to kill it again is already installed and running.

What could happen next?

Consequence
China's DPI hardware converts Iran's internet kill-switch from an emergency measure requiring days to implement into a standing capability operable in seconds, permanently changing the information-control architecture regardless of any future civilian presidential order.
Risk
VPN saturation at 35 to 40 million users, built during the 90-day blackout, means any future selective restoration will face an already-circumventing user base that is harder to track than a population encountering VPNs for the first time.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: China sealed Xinjiang's internet from the rest of the country for ten months between July 2009 and May 2010 following Urumqi riots, then restored it in tiers: commercial banking first, social media last.

Iran's tiered restoration under the 'Internet Pro' scheme and then Pezeshkian's 25 May order replicate that sequence exactly. The structural mechanism: partial restoration at commercial bandwidth with social-media filtering kept active reduces economic damage from the blackout while preserving political-information control.

Counter-parallel: Russia's 2022 attempt to use SORM-3 DPI hardware to throttle Twitter after the Ukraine invasion was technically partially effective but produced a domestic Streisand effect: Russian VPN downloads spiked 2,000% in a week, making the throttling visible and politically costly.

Iran's blackout has run for 90 days rather than a week, so VPN adoption is already embedded rather than reactive, and the DPI hardware is being installed into an environment where evasion is the baseline user behaviour.

NetBlocks' cumulative cost estimate for Iran's 90-day blackout exceeded $1 billion by mid-May , with the Euronews three-tier pricing report showing the commercial VPN tier cost Iranian consumers the equivalent of €2.50 per gigabyte versus €0.20 for the licensed professional tier, a 12.5x differential.

At 40% of pre-war traffic, the economic loss from the residual 60% gap continues to compound at roughly $15 to $20 million per day in e-Commerce, fintech, and remote-work activity.

The Chinese DPI hardware import represents a separate capital expenditure. Systems of the type Sarafraz described (nationwide carrier-grade DPI capable of encrypted-traffic inspection at scale) cost $50 to $200 million depending on throughput capacity. That capital outlay transforms a reactive emergency measure into a permanent infrastructure asset, shifting the cost from a crisis response into a state-infrastructure investment line.

Consensus view: Stanford Internet Observatory director Alex Stamos and Oxford Internet Institute researcher Samantha Bradshaw assess the Sarafraz disclosure as confirmation of Iran completing its 'splinternet' architecture: the Chinese deep-packet-inspection (DPI) hardware enables selective restoration at exactly the level needed to prevent economic protests over the blackout while retaining the ability to cut again before any coordinated opposition event.

At 40% of pre-war traffic, Iran's internet is above the economic pain threshold but below the coordination threshold that enabled the 2019 protests.

Counter-view: Citizen Lab's Ron Deibert and Iranian digital-rights researcher Afsaneh Rigot of Harvard's Berkman Klein Center argue that VPN penetration in Iran has reached saturation since the February blackout: roughly 35 to 40 million Iranians now use circumvention tools daily, meaning the DPI hardware's filtering efficacy is already degraded by the user-layer workarounds it was designed to prevent. The 40% recovery figure may undercount actual connectivity once VPN traffic is included.

Key tension: Whether the Chinese DPI system operates as a genuine on/off capability, as Sarafraz claimed, or whether VPN saturation means the real information-control ceiling is substantially lower than a technical kill-switch implies.

Sources:TechTimes

Mentions:Masoud Pezeshkian →NetBlocks →Mohammad Sarafraz →Supreme Council of Cyberspace →China →Iran →Internet Pro →Tehran →Ukraine →Russia →Xinjiang →

First Reported In

Update #112 · Treasury opens a second Iran sanctions front

TechTimes· 30 May 2026

Read original →

Causes and effects

Caused by

Iran lifts record blackout, 2,093 hours

Pezeshkian's 25 May restoration order was the direct cause of the 28 May partial-recovery measurement; the 40% figure is the outcome of that order.

Occurred 25 May 2026

Read story →

Iran buys China's internet control dial

Sarafraz's 23 May confirmation that Chinese DPI hardware was installed is the structural backdrop to why the restoration is capped at 40% and why any future blackout can be instant.

Occurred 23 May 2026

Read story →

Hegseth threatens Iran strikes in Singapore

China's visible Shangri-La non-alignment is consistent with Beijing having already deployed internet kill-switch hardware constraining Iran's connectivity.

Occurred 30 May 2026

Read story →

This Event

Iran's internet returns at 40%, by design

The partial recovery hands Tehran an on-demand kill switch, lowering the political cost of every future shutdown.

Different Perspectives

Trump administration

Washington defends the MATCH Act as closing a loophole that lets ASML's DUV tools reach Chinese fabs indirectly, dismissing the Dutch Cabinet's June complaint of being treated with disregard. Officials expect the bill's progress through Congress to keep the DUV cross-subsidy question live regardless of ASML's Q2 numbers.

Bruegel

Brussels-based economists argue this week's deliverables, specialist fab aid and a digital euro that restricts no US firm, prove Europe's sovereignty agenda advances only where it meets no American resistance. They expect the leading-edge fabrication gap and dependence on US frontier AI models to persist absent a policy that directly confronts a named US interest.

German federal government

Berlin welcomes the €659m tranche funding jobs across North Rhine-Westphalia, Schleswig-Holstein, Hesse and Bavaria, on top of the ESMC Dresden fab already under construction on TSMC-shipped tooling. Officials treat power and analogue capacity as the achievable near-term win while Dresden remains Germany's only bet on leading-edge logic.

House of Commons Science, Innovation and Technology Committee

The committee's 7 July report found the UK has "no coherent strategic framework" for sovereign technology and warns it "risks being cut off at whim", citing the June order that barred foreign access to Anthropic's Fable 5 and Mythos 5 as the trigger case. It expects no domestic hyperscaler or foundry response before the gap widens further.

European Commission

The Commission cleared €659m in German state aid on 14 July, taking cumulative Chips Act support to roughly €14.2bn, and let the digital-euro mandate reach trilogue after ECON's floor-vote shortcut was overturned. Brussels presents both as sovereignty delivered, without addressing that neither funds leading-edge logic fabrication.

ASML

ASML raised FY2026 guidance to €43-45bn on 15 July and, for the first time since Q1, dropped the export-control hedge from its release even with the MATCH Act live in Congress. Fouquet frames the order book, 86 systems against 67 in Q1, as strong enough to outrun the DUV dispute rather than evidence it has cooled.