26JUL

Iran's internet returns at 40%, by design

3 min read

10:21UTC

Iran's internet reached only 40 per cent of pre-war traffic by 28 May, NetBlocks reported, with Chinese-built hardware for a permanent, switchable blackout already installed.

← Back to The €890m fine that cost more than it collects Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Iran rebuilt its internet around a Chinese-built switch it can flip off at will.

Iran's internet reached only about 40 per cent of pre-war traffic by 28 May, the monitor NetBlocks reported, three days after President Masoud Pezeshkian's 25 May restoration order ended the longest national shutdown on record . ¹ NetBlocks is the UK-based watchdog that measures connectivity disruptions worldwide. In practice most Iranians remain effectively offline, and those who do reconnect stay on virtual private networks, the tools that route traffic abroad to evade state filtering, expecting the next shutdown.

Mohammad Sarafraz, a member of Iran's Supreme Council of Cyberspace, confirmed that Chinese-built deep-packet-inspection hardware for a permanent, switchable blackout has been imported and installed . ² Deep-packet inspection lets the state read and block traffic by content rather than crudely severing the line.

Iranians are back online inside a system that can be cut by a single decision, with the Chinese equipment already wired in. The 40 per cent figure is the visible change; the switchable hardware behind it is the durable one. Iran has compressed the timeline China used in Xinjiang, where a ten-month isolation in 2009 was followed by embedded inspection hardware, installing the architecture during the war rather than after it. The next blackout need not be an emergency dragged out for weeks. It can be a switch, and VPN use stays heavy because ordinary users assume the next cut is a matter of when, not whether. ³

Deep Analysis

In plain English

Iran's government shut off most of its internet on 28 February when the war started. President Pezeshkian ordered it restored on 25 May. Three days later, on 28 May, only about 40% of normal traffic was flowing, according to the monitoring service NetBlocks. Most people are still effectively offline, and those who can connect use VPNs because they expect the government to cut it again. A senior official called Mohammad Sarafraz confirmed that China supplied Iran with hardware that lets the government switch internet access on or off instantly, by region or across the whole country. So the restoration is partial by design, and the hardware to kill it again is already installed and running.

What could happen next?

Consequence
China's DPI hardware converts Iran's internet kill-switch from an emergency measure requiring days to implement into a standing capability operable in seconds, permanently changing the information-control architecture regardless of any future civilian presidential order.
Risk
VPN saturation at 35 to 40 million users, built during the 90-day blackout, means any future selective restoration will face an already-circumventing user base that is harder to track than a population encountering VPNs for the first time.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: China sealed Xinjiang's internet from the rest of the country for ten months between July 2009 and May 2010 following Urumqi riots, then restored it in tiers: commercial banking first, social media last.

Iran's tiered restoration under the 'Internet Pro' scheme and then Pezeshkian's 25 May order replicate that sequence exactly. The structural mechanism: partial restoration at commercial bandwidth with social-media filtering kept active reduces economic damage from the blackout while preserving political-information control.

Counter-parallel: Russia's 2022 attempt to use SORM-3 DPI hardware to throttle Twitter after the Ukraine invasion was technically partially effective but produced a domestic Streisand effect: Russian VPN downloads spiked 2,000% in a week, making the throttling visible and politically costly.

Iran's blackout has run for 90 days rather than a week, so VPN adoption is already embedded rather than reactive, and the DPI hardware is being installed into an environment where evasion is the baseline user behaviour.

NetBlocks' cumulative cost estimate for Iran's 90-day blackout exceeded $1 billion by mid-May , with the Euronews three-tier pricing report showing the commercial VPN tier cost Iranian consumers the equivalent of €2.50 per gigabyte versus €0.20 for the licensed professional tier, a 12.5x differential.

At 40% of pre-war traffic, the economic loss from the residual 60% gap continues to compound at roughly $15 to $20 million per day in e-commerce, fintech, and remote-work activity.

The Chinese DPI hardware import represents a separate capital expenditure. Systems of the type Sarafraz described (nationwide carrier-grade DPI capable of encrypted-traffic inspection at scale) cost $50 to $200 million depending on throughput capacity. That capital outlay transforms a reactive emergency measure into a permanent infrastructure asset, shifting the cost from a crisis response into a state-infrastructure investment line.

Consensus view: Stanford Internet Observatory director Alex Stamos and Oxford Internet Institute researcher Samantha Bradshaw assess the Sarafraz disclosure as confirmation of Iran completing its 'splinternet' architecture: the Chinese deep-packet-inspection (DPI) hardware enables selective restoration at exactly the level needed to prevent economic protests over the blackout while retaining the ability to cut again before any coordinated opposition event.

At 40% of pre-war traffic, Iran's internet is above the economic pain threshold but below the coordination threshold that enabled the 2019 protests.

Counter-view: Citizen Lab's Ron Deibert and Iranian digital-rights researcher Afsaneh Rigot of Harvard's Berkman Klein Center argue that VPN penetration in Iran has reached saturation since the February blackout: roughly 35 to 40 million Iranians now use circumvention tools daily, meaning the DPI hardware's filtering efficacy is already degraded by the user-layer workarounds it was designed to prevent. The 40% recovery figure may undercount actual connectivity once VPN traffic is included.

Key tension: Whether the Chinese DPI system operates as a genuine on/off capability, as Sarafraz claimed, or whether VPN saturation means the real information-control ceiling is substantially lower than a technical kill-switch implies.

Sources:TechTimes

Mentions:Masoud Pezeshkian →NetBlocks →Mohammad Sarafraz →Supreme Council of Cyberspace →China →Iran →Internet Pro →Tehran →Ukraine →Russia →Xinjiang →

First Reported In

Update #112 · Treasury opens a second Iran sanctions front

TechTimes· 30 May 2026

Read original →

Causes and effects

Caused by

Iran lifts record blackout, 2,093 hours

Pezeshkian's 25 May restoration order was the direct cause of the 28 May partial-recovery measurement; the 40% figure is the outcome of that order.

Occurred 25 May 2026

Read story →

Iran buys China's internet control dial

Sarafraz's 23 May confirmation that Chinese DPI hardware was installed is the structural backdrop to why the restoration is capped at 40% and why any future blackout can be instant.

Occurred 23 May 2026

Read story →

Hegseth threatens Iran strikes in Singapore

China's visible Shangri-La non-alignment is consistent with Beijing having already deployed internet kill-switch hardware constraining Iran's connectivity.

Occurred 30 May 2026

Read story →

This Event

Iran's internet returns at 40%, by design

The partial recovery hands Tehran an on-demand kill switch, lowering the political cost of every future shutdown.

Different Perspectives

China's Ministry of Commerce

Spokesperson He Yadong said on 16 July that Beijing and the Netherlands should let firms settle the Nexperia dispute through consultation, after a Dutch ministerial visit to Beijing. The conciliatory tone contrasts with the confrontational US trade response to the same fortnight's DMA enforcement.

Samsung Electronics

Samsung entered talks reported 22 July to invest up to €1 billion in Mistral AI, part of a round valuing the French lab at roughly €20 billion alongside EQT, Novo Holdings and Santander. The Korean conglomerate, not an EU financing instrument, is positioned to anchor Europe's flagship AI lab.

Poland (Tusk government)

Donald Tusk's government proposed a mandatory sovereignty test on 21 July for state technology contracts above 5 million zloty, scoring bids on AI model-weight rights and vendor lock-in rather than waiting for an EU-wide procurement rule. The threshold targets a 20-30 per cent domestic-alternative share.

United States administration

Donald Trump ordered a Section 301 investigation into EU digital-enforcement practices on 24 July, a day after USTR's Jamieson Greer said the Google fine created massive uncertainty for US exports, noting Google's cumulative EU fines already exceed 2 per cent of the bloc's budget.

Ecosia

Ecosia said the 16 July FRAND ranking-data order would take it from answering two-thirds of queries to all of them once the obligation activates in January 2027. The Berlin-based challenger has not called the enforcement package adequate, only workable if Google complies rather than appeals.

European Commission

Teresa Ribera and Henna Virkkunen announced the €890m fine on 23 July, saying products should succeed on merit, not platform ownership; four days earlier a separate Article 6(7) order compelled Android interoperability. The Commission expects both to hold on appeal after the Court of Justice upheld its earlier €4.1bn Android fine on 2 July.