30MAY

Iran's internet returns at 40%, by design

3 min read

10:17UTC

Iran's internet reached only 40 per cent of pre-war traffic by 28 May, NetBlocks reported, with Chinese-built hardware for a permanent, switchable blackout already installed.

← Back to Treasury opens a second Iran sanctions front Jump to analysis ↓

ConflictDeveloping

Key takeaway

Iran rebuilt its internet around a Chinese-built switch it can flip off at will.

Iran's internet reached only about 40 per cent of pre-war traffic by 28 May, the monitor NetBlocks reported, three days after President Masoud Pezeshkian's 25 May restoration order ended the longest national shutdown on record . ¹ NetBlocks is the UK-based watchdog that measures connectivity disruptions worldwide. In practice most Iranians remain effectively offline, and those who do reconnect stay on virtual private networks, the tools that route traffic abroad to evade state filtering, expecting the next shutdown.

Mohammad Sarafraz, a member of Iran's Supreme Council of Cyberspace, confirmed that Chinese-built deep-packet-inspection hardware for a permanent, switchable blackout has been imported and installed . ² Deep-packet inspection lets the state read and block traffic by content rather than crudely severing the line.

Iranians are back online inside a system that can be cut by a single decision, with the Chinese equipment already wired in. The 40 per cent figure is the visible change; the switchable hardware behind it is the durable one. Iran has compressed the timeline China used in Xinjiang, where a ten-month isolation in 2009 was followed by embedded inspection hardware, installing the architecture during the war rather than after it. The next blackout need not be an emergency dragged out for weeks. It can be a switch, and VPN use stays heavy because ordinary users assume the next cut is a matter of when, not whether. ³

Deep Analysis

In plain English

Iran's government shut off most of its internet on 28 February when the war started. President Pezeshkian ordered it restored on 25 May. Three days later, on 28 May, only about 40% of normal traffic was flowing, according to the monitoring service NetBlocks. Most people are still effectively offline, and those who can connect use VPNs because they expect the government to cut it again. A senior official called Mohammad Sarafraz confirmed that China supplied Iran with hardware that lets the government switch internet access on or off instantly, by region or across the whole country. So the restoration is partial by design, and the hardware to kill it again is already installed and running.

What could happen next?

Consequence
China's DPI hardware converts Iran's internet kill-switch from an emergency measure requiring days to implement into a standing capability operable in seconds, permanently changing the information-control architecture regardless of any future civilian presidential order.
Risk
VPN saturation at 35 to 40 million users, built during the 90-day blackout, means any future selective restoration will face an already-circumventing user base that is harder to track than a population encountering VPNs for the first time.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: China sealed Xinjiang's internet from the rest of the country for ten months between July 2009 and May 2010 following Urumqi riots, then restored it in tiers: commercial banking first, social media last.

Iran's tiered restoration under the 'Internet Pro' scheme (ID:3498) and then Pezeshkian's 25 May order replicate that sequence exactly. The structural mechanism: partial restoration at commercial bandwidth with social-media filtering kept active reduces economic damage from the blackout while preserving political-information control.

Counter-parallel: Russia's 2022 attempt to use SORM-3 DPI hardware to throttle Twitter after the Ukraine invasion was technically partially effective but produced a domestic Streisand effect: Russian VPN downloads spiked 2,000% in a week, making the throttling visible and politically costly.

Iran's blackout has run for 90 days rather than a week, so VPN adoption is already embedded rather than reactive, and the DPI hardware is being installed into an environment where evasion is the baseline user behaviour.

NetBlocks' cumulative cost estimate for Iran's 90-day blackout exceeded $1 billion by mid-May , with the Euronews three-tier pricing report showing the commercial VPN tier cost Iranian consumers the equivalent of €2.50 per gigabyte versus €0.20 for the licensed professional tier, a 12.5x differential.

At 40% of pre-war traffic, the economic loss from the residual 60% gap continues to compound at roughly $15 to $20 million per day in e-Commerce, fintech, and remote-work activity.

The Chinese DPI hardware import represents a separate capital expenditure. Systems of the type Sarafraz described (nationwide carrier-grade DPI capable of encrypted-traffic inspection at scale) cost $50 to $200 million depending on throughput capacity. That capital outlay transforms a reactive emergency measure into a permanent infrastructure asset, shifting the cost from a crisis response into a state-infrastructure investment line.

Consensus view: Stanford Internet Observatory director Alex Stamos and Oxford Internet Institute researcher Samantha Bradshaw assess the Sarafraz disclosure as confirmation of Iran completing its 'splinternet' architecture: the Chinese deep-packet-inspection (DPI) hardware enables selective restoration at exactly the level needed to prevent economic protests over the blackout while retaining the ability to cut again before any coordinated opposition event.

At 40% of pre-war traffic, Iran's internet is above the economic pain threshold but below the coordination threshold that enabled the 2019 protests.

Counter-view: Citizen Lab's Ron Deibert and Iranian digital-rights researcher Afsaneh Rigot of Harvard's Berkman Klein Center argue that VPN penetration in Iran has reached saturation since the February blackout: roughly 35 to 40 million Iranians now use circumvention tools daily, meaning the DPI hardware's filtering efficacy is already degraded by the user-layer workarounds it was designed to prevent. The 40% recovery figure may undercount actual connectivity once VPN traffic is included.

Key tension: Whether the Chinese DPI system operates as a genuine on/off capability, as Sarafraz claimed, or whether VPN saturation means the real information-control ceiling is substantially lower than a technical kill-switch implies.

Sources:TechTimes

Mentions:Masoud Pezeshkian →NetBlocks →Mohammad Sarafraz →Supreme Council of Cyberspace →China →Iran →Internet Pro →Tehran →Ukraine →Russia →Xinjiang →

First Reported In

Update #112 · Treasury opens a second Iran sanctions front

TechTimes· 30 May 2026

Read original →

Causes and effects

Caused by

Iran lifts record blackout, 2,093 hours

Pezeshkian's 25 May restoration order was the direct cause of the 28 May partial-recovery measurement; the 40% figure is the outcome of that order.

Occurred 25 May 2026

Read story →

Iran buys China's internet control dial

Sarafraz's 23 May confirmation that Chinese DPI hardware was installed is the structural backdrop to why the restoration is capped at 40% and why any future blackout can be instant.

Occurred 23 May 2026

Read story →

This Event

Iran's internet returns at 40%, by design

The partial recovery hands Tehran an on-demand kill switch, lowering the political cost of every future shutdown.

Different Perspectives

Qatar

Qatar holds approximately $12 billion in frozen Iranian assets that Tehran named as the precondition for any Hormuz reopening sequence; with Oman sidelined and no agreed HEU custodian, the asset-routing architecture that any deal requires has no operational channel and no neutral financial intermediary to run it through.

Hengaw and Iranian civilian population

Iranians face an internet capped at 40 per cent by hardware their president cannot dismantle, field killings that leave no court record, and judicial executions running in parallel; Hengaw, based in Norway, is the primary remaining monitor of a repression system the IRGC is deliberately moving beyond auditable records. The real toll is higher than any single monitor's count.

China

China supplied deep-packet-inspection hardware that caps Iran's internet at 40 per cent and enables an instant on-demand blackout, and was barred by Trump as a potential HEU custodian on 27 May. Beijing gains from Iran's continued non-alignment with the West while the DPI sale extends Chinese surveillance-technology exports as a geopolitical instrument.

Pakistan

Foreign Minister Ishaq Dar met Rubio in Washington on 29 May, formally inheriting the role of sole active mediator after Oman's forced withdrawal. Pakistan lacks Oman's banking infrastructure for frozen-asset routing and carries its own regional stakes, making it a less structurally neutral broker for the Qatar-held $12 billion sequencing.

Kuwait

Kuwait invoked Article 51 of the UN Charter after absorbing an Iranian ballistic-missile strike on Ali Al Salem Air Base on 28 May, becoming the first Gulf state to make a formal individual self-defence claim in the war. The invocation creates a legal record enabling a future bilateral defence-pact activation without yet triggering it.

Oman

Oman denied any Hormuz toll plan within hours of Bessent's 28 May threat, absorbing a sanctions warning from the country it has brokered for since 1981. The rapid capitulation preserved the channel formally, but Tehran now knows Washington will threaten its own mediator, which changes Muscat's calculus on how far it can lean into any joint-management architecture.