8SEP

Iran's internet returns at 40%, by design

3 min read

15:06UTC

Iran's internet reached only 40 per cent of pre-war traffic by 28 May, NetBlocks reported, with Chinese-built hardware for a permanent, switchable blackout already installed.

← Back to Mistral closes EUR 3bn; Luxembourg buys in Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Iran rebuilt its internet around a Chinese-built switch it can flip off at will.

Iran's internet reached only about 40 per cent of pre-war traffic by 28 May, the monitor NetBlocks reported, three days after President Masoud Pezeshkian's 25 May restoration order ended the longest national shutdown on record . ¹ NetBlocks is the UK-based watchdog that measures connectivity disruptions worldwide. In practice most Iranians remain effectively offline, and those who do reconnect stay on virtual private networks, the tools that route traffic abroad to evade state filtering, expecting the next shutdown.

Mohammad Sarafraz, a member of Iran's Supreme Council of Cyberspace, confirmed that Chinese-built deep-packet-inspection hardware for a permanent, switchable blackout has been imported and installed . ² Deep-packet inspection lets the state read and block traffic by content rather than crudely severing the line.

Iranians are back online inside a system that can be cut by a single decision, with the Chinese equipment already wired in. The 40 per cent figure is the visible change; the switchable hardware behind it is the durable one. Iran has compressed the timeline China used in Xinjiang, where a ten-month isolation in 2009 was followed by embedded inspection hardware, installing the architecture during the war rather than after it. The next blackout need not be an emergency dragged out for weeks. It can be a switch, and VPN use stays heavy because ordinary users assume the next cut is a matter of when, not whether. ³

Deep Analysis

In plain English

Iran's government shut off most of its internet on 28 February when the war started. President Pezeshkian ordered it restored on 25 May. Three days later, on 28 May, only about 40% of normal traffic was flowing, according to the monitoring service NetBlocks. Most people are still effectively offline, and those who can connect use VPNs because they expect the government to cut it again. A senior official called Mohammad Sarafraz confirmed that China supplied Iran with hardware that lets the government switch internet access on or off instantly, by region or across the whole country. So the restoration is partial by design, and the hardware to kill it again is already installed and running.

What could happen next?

Consequence
China's DPI hardware converts Iran's internet kill-switch from an emergency measure requiring days to implement into a standing capability operable in seconds, permanently changing the information-control architecture regardless of any future civilian presidential order.
Risk
VPN saturation at 35 to 40 million users, built during the 90-day blackout, means any future selective restoration will face an already-circumventing user base that is harder to track than a population encountering VPNs for the first time.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: China sealed Xinjiang's internet from the rest of the country for ten months between July 2009 and May 2010 following Urumqi riots, then restored it in tiers: commercial banking first, social media last.

Iran's tiered restoration under the 'Internet Pro' scheme and then Pezeshkian's 25 May order replicate that sequence exactly. The structural mechanism: partial restoration at commercial bandwidth with social-media filtering kept active reduces economic damage from the blackout while preserving political-information control.

Counter-parallel: Russia's 2022 attempt to use SORM-3 DPI hardware to throttle Twitter after the Ukraine invasion was technically partially effective but produced a domestic Streisand effect: Russian VPN downloads spiked 2,000% in a week, making the throttling visible and politically costly.

Iran's blackout has run for 90 days rather than a week, so VPN adoption is already embedded rather than reactive, and the DPI hardware is being installed into an environment where evasion is the baseline user behaviour.

NetBlocks' cumulative cost estimate for Iran's 90-day blackout exceeded $1 billion by mid-May , with the Euronews three-tier pricing report showing the commercial VPN tier cost Iranian consumers the equivalent of €2.50 per gigabyte versus €0.20 for the licensed professional tier, a 12.5x differential.

At 40% of pre-war traffic, the economic loss from the residual 60% gap continues to compound at roughly $15 to $20 million per day in e-commerce, fintech, and remote-work activity.

The Chinese DPI hardware import represents a separate capital expenditure. Systems of the type Sarafraz described (nationwide carrier-grade DPI capable of encrypted-traffic inspection at scale) cost $50 to $200 million depending on throughput capacity. That capital outlay transforms a reactive emergency measure into a permanent infrastructure asset, shifting the cost from a crisis response into a state-infrastructure investment line.

Consensus view: Stanford Internet Observatory director Alex Stamos and Oxford Internet Institute researcher Samantha Bradshaw assess the Sarafraz disclosure as confirmation of Iran completing its 'splinternet' architecture: the Chinese deep-packet-inspection (DPI) hardware enables selective restoration at exactly the level needed to prevent economic protests over the blackout while retaining the ability to cut again before any coordinated opposition event.

At 40% of pre-war traffic, Iran's internet is above the economic pain threshold but below the coordination threshold that enabled the 2019 protests.

Counter-view: Citizen Lab's Ron Deibert and Iranian digital-rights researcher Afsaneh Rigot of Harvard's Berkman Klein Center argue that VPN penetration in Iran has reached saturation since the February blackout: roughly 35 to 40 million Iranians now use circumvention tools daily, meaning the DPI hardware's filtering efficacy is already degraded by the user-layer workarounds it was designed to prevent. The 40% recovery figure may undercount actual connectivity once VPN traffic is included.

Key tension: Whether the Chinese DPI system operates as a genuine on/off capability, as Sarafraz claimed, or whether VPN saturation means the real information-control ceiling is substantially lower than a technical kill-switch implies.

Sources:TechTimes

Mentions:Masoud Pezeshkian →NetBlocks →Mohammad Sarafraz →Supreme Council of Cyberspace →China →Iran →Internet Pro →Tehran →Ukraine →Russia →Xinjiang →

First Reported In

Update #112 · Treasury opens a second Iran sanctions front

TechTimes· 30 May 2026

Read original →

Causes and effects

Caused by

Iran lifts record blackout, 2,093 hours

Pezeshkian's 25 May restoration order was the direct cause of the 28 May partial-recovery measurement; the 40% figure is the outcome of that order.

Occurred 25 May 2026

Read story →

Iran buys China's internet control dial

Sarafraz's 23 May confirmation that Chinese DPI hardware was installed is the structural backdrop to why the restoration is capped at 40% and why any future blackout can be instant.

Occurred 23 May 2026

Read story →

Hegseth threatens Iran strikes in Singapore

China's visible Shangri-La non-alignment is consistent with Beijing having already deployed internet kill-switch hardware constraining Iran's connectivity.

Occurred 30 May 2026

Read story →

This Event

Iran's internet returns at 40%, by design

The partial recovery hands Tehran an on-demand kill switch, lowering the political cost of every future shutdown.

Different Perspectives

Poland

Poland leads a self-announced AI Gigafactory consortium with a EUR 100 million phase-one commitment, matched by Czechia and joined by Hungary at EUR 25 million. EuroHPC has confirmed no consortium for the call closing 12 November, so the bloc exists only in national announcements so far.

UK Government (DCMS)

Secretary of State Lisa Nandy told the Commons on 3 September she has inherited the sovereign AI brief from Liz Kendall, but gave no assessment, figure or date on frontier-model access. It is the first public claim of ownership since DSIT's abolition, without the substance the committee asked for.

ASML

ASML CEO Christophe Fouquet credited Intel Foundry, not a European fab, with shipping the first high-volume logic product made on High-NA EUV, the tool only ASML builds. Europe holds the chokepoint tool; the company that spent it into volume production first is American.

Luxembourg

Luxembourg joined Mistral's Series D as a new investor on 8 September, the same government that co-funds EuroHPC's MeluXina-AI supercomputer. One small member state now funds the sovereign compute Mistral may need and holds equity in the company using it.

Samsung Electronics

Samsung led Mistral's Series D on 8 September and the same day expanded its ASML collaboration on next-generation lithography. One Korean company now sits atop Europe's largest AI funding round and inside its most sensitive chip-tooling relationship.

Mistral AI

Mistral closed a EUR 3 billion Series D above a EUR 21 billion valuation on 8 September, with Samsung leading and Luxembourg joining as a new state investor. The company markets itself as Europe's non-American AI option even as the round's lead capital comes from South Korea and two US private-equity firms.