5JUN

Iran's internet returns at 40%, by design

3 min read

08:43UTC

Iran's internet reached only 40 per cent of pre-war traffic by 28 May, NetBlocks reported, with Chinese-built hardware for a permanent, switchable blackout already installed.

← Back to Hezbollah veto stalls Iran-US deal Jump to analysis ↓

ConflictDeveloping

Key takeaway

Iran rebuilt its internet around a Chinese-built switch it can flip off at will.

Iran's internet reached only about 40 per cent of pre-war traffic by 28 May, the monitor NetBlocks reported, three days after President Masoud Pezeshkian's 25 May restoration order ended the longest national shutdown on record . ¹ NetBlocks is the UK-based watchdog that measures connectivity disruptions worldwide. In practice most Iranians remain effectively offline, and those who do reconnect stay on virtual private networks, the tools that route traffic abroad to evade state filtering, expecting the next shutdown.

Mohammad Sarafraz, a member of Iran's Supreme Council of Cyberspace, confirmed that Chinese-built deep-packet-inspection hardware for a permanent, switchable blackout has been imported and installed . ² Deep-packet inspection lets the state read and block traffic by content rather than crudely severing the line.

Iranians are back online inside a system that can be cut by a single decision, with the Chinese equipment already wired in. The 40 per cent figure is the visible change; the switchable hardware behind it is the durable one. Iran has compressed the timeline China used in Xinjiang, where a ten-month isolation in 2009 was followed by embedded inspection hardware, installing the architecture during the war rather than after it. The next blackout need not be an emergency dragged out for weeks. It can be a switch, and VPN use stays heavy because ordinary users assume the next cut is a matter of when, not whether. ³

Deep Analysis

In plain English

Iran's government shut off most of its internet on 28 February when the war started. President Pezeshkian ordered it restored on 25 May. Three days later, on 28 May, only about 40% of normal traffic was flowing, according to the monitoring service NetBlocks. Most people are still effectively offline, and those who can connect use VPNs because they expect the government to cut it again. A senior official called Mohammad Sarafraz confirmed that China supplied Iran with hardware that lets the government switch internet access on or off instantly, by region or across the whole country. So the restoration is partial by design, and the hardware to kill it again is already installed and running.

What could happen next?

Consequence
China's DPI hardware converts Iran's internet kill-switch from an emergency measure requiring days to implement into a standing capability operable in seconds, permanently changing the information-control architecture regardless of any future civilian presidential order.
Risk
VPN saturation at 35 to 40 million users, built during the 90-day blackout, means any future selective restoration will face an already-circumventing user base that is harder to track than a population encountering VPNs for the first time.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: China sealed Xinjiang's internet from the rest of the country for ten months between July 2009 and May 2010 following Urumqi riots, then restored it in tiers: commercial banking first, social media last.

Iran's tiered restoration under the 'Internet Pro' scheme and then Pezeshkian's 25 May order replicate that sequence exactly. The structural mechanism: partial restoration at commercial bandwidth with social-media filtering kept active reduces economic damage from the blackout while preserving political-information control.

Counter-parallel: Russia's 2022 attempt to use SORM-3 DPI hardware to throttle Twitter after the Ukraine invasion was technically partially effective but produced a domestic Streisand effect: Russian VPN downloads spiked 2,000% in a week, making the throttling visible and politically costly.

Iran's blackout has run for 90 days rather than a week, so VPN adoption is already embedded rather than reactive, and the DPI hardware is being installed into an environment where evasion is the baseline user behaviour.

NetBlocks' cumulative cost estimate for Iran's 90-day blackout exceeded $1 billion by mid-May , with the Euronews three-tier pricing report showing the commercial VPN tier cost Iranian consumers the equivalent of €2.50 per gigabyte versus €0.20 for the licensed professional tier, a 12.5x differential.

At 40% of pre-war traffic, the economic loss from the residual 60% gap continues to compound at roughly $15 to $20 million per day in e-commerce, fintech, and remote-work activity.

The Chinese DPI hardware import represents a separate capital expenditure. Systems of the type Sarafraz described (nationwide carrier-grade DPI capable of encrypted-traffic inspection at scale) cost $50 to $200 million depending on throughput capacity. That capital outlay transforms a reactive emergency measure into a permanent infrastructure asset, shifting the cost from a crisis response into a state-infrastructure investment line.

Consensus view: Stanford Internet Observatory director Alex Stamos and Oxford Internet Institute researcher Samantha Bradshaw assess the Sarafraz disclosure as confirmation of Iran completing its 'splinternet' architecture: the Chinese deep-packet-inspection (DPI) hardware enables selective restoration at exactly the level needed to prevent economic protests over the blackout while retaining the ability to cut again before any coordinated opposition event.

At 40% of pre-war traffic, Iran's internet is above the economic pain threshold but below the coordination threshold that enabled the 2019 protests.

Counter-view: Citizen Lab's Ron Deibert and Iranian digital-rights researcher Afsaneh Rigot of Harvard's Berkman Klein Center argue that VPN penetration in Iran has reached saturation since the February blackout: roughly 35 to 40 million Iranians now use circumvention tools daily, meaning the DPI hardware's filtering efficacy is already degraded by the user-layer workarounds it was designed to prevent. The 40% recovery figure may undercount actual connectivity once VPN traffic is included.

Key tension: Whether the Chinese DPI system operates as a genuine on/off capability, as Sarafraz claimed, or whether VPN saturation means the real information-control ceiling is substantially lower than a technical kill-switch implies.

Sources:TechTimes

Mentions:Masoud Pezeshkian →NetBlocks →Mohammad Sarafraz →Supreme Council of Cyberspace →China →Iran →Internet Pro →Tehran →Ukraine →Russia →Xinjiang →

First Reported In

Update #112 · Treasury opens a second Iran sanctions front

TechTimes· 30 May 2026

Read original →

Causes and effects

Caused by

Iran lifts record blackout, 2,093 hours

Pezeshkian's 25 May restoration order was the direct cause of the 28 May partial-recovery measurement; the 40% figure is the outcome of that order.

Occurred 25 May 2026

Read story →

Iran buys China's internet control dial

Sarafraz's 23 May confirmation that Chinese DPI hardware was installed is the structural backdrop to why the restoration is capped at 40% and why any future blackout can be instant.

Occurred 23 May 2026

Read story →

Hegseth threatens Iran strikes in Singapore

China's visible Shangri-La non-alignment is consistent with Beijing having already deployed internet kill-switch hardware constraining Iran's connectivity.

Occurred 30 May 2026

Read story →

This Event

Iran's internet returns at 40%, by design

The partial recovery hands Tehran an on-demand kill switch, lowering the political cost of every future shutdown.

Different Perspectives

Israel

IDF Chief Eyal Zamir declared on 3 June there was no ceasefire for his forces, and strikes killed at least 10 civilians and one Israeli soldier on 4 June. The IDF killed Hezbollah's chief engineer and warned three south Lebanon villages to evacuate on 5 June, advancing into ground the unsigned Washington framework has not caught.

Hezbollah / Lebanon

Naim Qassem rejected the Washington Lebanon framework on 4 June as "absurd, humiliating and insulting", blocking a ceasefire instrument that required Hezbollah to withdraw north of the Litani before any Israeli withdrawal. Over one million Lebanese remain displaced; the framework's collapse prolongs that toll.

Iran

Foreign Minister Araghchi publicly coupled the Lebanon ceasefire to the Iran-US nuclear track on 4 June, carrying IRGC authority rather than his own civilian mandate. The IRGC delegation has sent no HEU counter-proposal since Araghchi confirmed no progress that same day; Mojtaba Khamenei's 21 May order to keep the 440.9 kg stockpile inside Iran remains operative.

United States

Rubio placed the Iran-US deal at 95 per cent complete on 4 June while the administration signed no Iran instrument and OFAC designated only Cuban targets. Trump separately disclosed and rejected an airlift plan to collect Iran's HEU stockpile, claiming the material is "entombed", a claim the IAEA cannot verify.

China

Beijing's MOFCOM Blocking Rules constrain OFAC enforcement on the mainland; China has not corroborated Trump's verbal account of any bilateral summit, and the rial's failure to hold its Rubio bounce, combined with the IRGC's stablecoin rail closure, increases Chinese yuan-denominated oil-payment exposure through Hormuz.

Bahrain

The IRGC struck Bahrain on 3 June as its sirens sounded and its PAC-3 magazine neared exhaustion; excluded from Rubio's 2 May emergency resupply, Bahrain received a 50-round Federal Register notice on 1 June on an 18-month delivery timeline, meaning it is defending the US Fifth Fleet headquarters on the last rounds it has.