18APR

Iran lifts record blackout, 2,093 hours

4 min read

14:57UTC

Iran's president ordered the internet restored after 2,093 hours, the longest national shutdown on record, but NetBlocks confirmed only a partial reopening with filtering still live.

← Back to Hormuz opens and closes in 24 hours Jump to analysis ↓

ConflictDeveloping

Key takeaway

Pezeshkian could flip the public internet on but not touch the IRGC hardware that filters it.

President Masoud Pezeshkian ordered Iran's internet blackout lifted on Monday 25 May 2026, and NetBlocks, the connectivity monitor, confirmed partial restoration on Tuesday 26 May after 2,093 hours, the longest nationwide shutdown in modern record ¹. The blackout had run from 28 February, the first day of the conflict, sealing a population off from the very negotiations its own foreign ministry was conducting abroad and costing more than $1 billion cumulatively . For ordinary Iranians the order opens the first uncensored window onto the war in nearly three months.

WhatsApp still needs circumvention tools and the filtering layer stays active, running on Chinese deep-packet-inspection hardware that lets the security state switch access on and off region by region . Pezeshkian does not hold that switch alone. He can turn the public internet back on; he cannot dismantle the plumbing underneath it.

Pezeshkian's writ runs through the presidency and the foreign ministry, while the IRGC's budget and command run through the Supreme Leader's office, not parliament. That divide is why a presidential order could restore service yet leave the censorship architecture intact. The same days that Pezeshkian asserted authority over the network, Ali Shamkhani, a voice for the security council, was publicly calling the deal his foreign minister is negotiating a fantasy. The counter-reading treats the restoration as a negotiating optic aimed at Washington and at a restive public, reversible the moment the security state chooses.

A reconnected population can now read the talks its government is running, which narrows the government's monopoly on what Iranians know about their own war.

Deep Analysis

In plain English

Since the 2026 Iran war began on 28 February, Iran's government shut down the internet for virtually all ordinary Iranians. Think of it as cutting off mobile and home broadband for 90 million people for nearly three months. The stated reason was to prevent coordination of protests and to stop sensitive military information leaking online. On 25 May, Iran's elected president, Masoud Pezeshkian, ordered the internet switched back on. By 26 May, an independent monitoring organisation called NetBlocks confirmed partial restoration. But 'partial' matters: WhatsApp and similar apps still do not work without a special workaround. The reason is that China supplied Iran with powerful filtering technology that sits deep inside the network. The president can turn the public switch on, but he does not control the filtering layer underneath, which the IRGC manages. So the internet came back, but in the same censored form Iran's citizens are used to, plus some additional blocks left in place from the war.

Deep Analysis

Root Causes

Iran's ability to conduct a 2,093-hour national internet blackout rests on a procurement decision made over several years before the 2026 conflict began.

Iran imported Chinese DPI hardware, specifically Huawei-grade systems capable of reading and blocking encrypted traffic at the network layer, through a programme disclosed publicly by Mohammad Sarafraz, a member of the Supreme Council of Cyberspace, on 23 May 2026. That council sits above the presidency in Iran's constitutional order; it reports to the Supreme Leader, not the cabinet.

The second structural cause is the tiered-access system the Supreme National Security Council built on top of the DPI layer: a 'white internet' for senior officials and select journalists, 'Internet Pro' at 40,000 tomans per gigabyte for licensed professionals, and commercial-VPN access at twelve times that rate for the general public.

This pricing architecture means restoring the public tier does not affect the security tier; the IRGC's command communications and Khamenei's office were never in the same network tier as ordinary Iranians.

What could happen next?

Consequence
Pezeshkian's order demonstrates civilian authority over the nominal public internet switch but does not touch the IRGC-controlled DPI layer, drawing a visible boundary between presidential and security-state power inside Iran's wartime structure.
Immediate · Assessed
Risk
The IRGC retains the technical capacity to reverse the partial restoration at regional level without a cabinet order; the diplomatic utility of the gesture to Washington may be extracted before the underlying power contest resolves.
Short term · Assessed
Precedent
A restored Iranian population can now read coverage of the Doha negotiations their own government is conducting, narrowing the 87-day information monopoly the security state held over domestic public opinion about the war.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: China's Xinjiang internet shutdown from July 2009 to May 2010 ran for 312 days, ten months, isolating 21 million people in a single province. Beijing used the same centralised-DPI architecture that Iran subsequently acquired. The Xinjiang shutdown was lifted in stages, with voice calls restored before data, and with filtering layers kept active after nominal restoration.

Iran's 2026 blackout reached 2,093 hours, roughly 87 days, across the entire country, a structurally parallel use of the same technology for the same stated purpose: blocking coordination of internal dissent during a security emergency. The post-Xinjiang lesson, documented by the Citizen Lab, is that 'restoration' under this architecture means a return to a filtered internet, not an open one.

Counter-parallel: Myanmar's post-coup internet shutdowns from February 2021 onward used a different enforcement model: Myanmar's military government ordered ISPs to cut connections under direct regulatory threat, without the centralised DPI layer.

When partial restoration occurred in May 2021, it was more complete because there was no state hardware inside the network to maintain selective filtering. Iran's Chinese DPI procurement means the Myanmar counter-parallel does not apply: Pezeshkian cannot execute a Myanmar-style full restoration even if he orders one.

The cumulative economic cost of the blackout exceeded $1bn by the time of partial restoration, per Hasht-e Subh citing aggregated data from Iranian business associations. The Netconf study group's pre-war baseline for Iran's internet-dependent GDP share was roughly 4-5%; at that share, 2,093 hours of near-total shutdown at normal GDP velocity implies a flow cost of around $1.1-1.3bn, consistent with the published estimate.

Partial restoration produces only partial economic recovery. WhatsApp, the primary cross-border business communication channel for Iranian exporters and diaspora remittance flows, remains blocked. The DPI layer's continued operation means financial messaging apps and some banking APIs that use the same encrypted-traffic profiles as WhatsApp also remain intermittently unavailable.

Consensus view: The Citizen Lab at the University of Toronto's Munk School, which has physically reverse-engineered Iran's Deep Packet Inspection (DPI) infrastructure, and Freedom House's Freedom on the Net team both assess that Pezeshkian's 25 May order reveals the limit of civilian writ precisely because the restoration is partial: the Chinese-supplied DPI hardware sits at the layer below any presidential decree and is procured and operated by the IRGC's signals intelligence directorate, not the Ministry of Information and Communications Technology that Pezeshkian controls.

Counter-view: Iran's ISPA (Internet Service Providers Association) and several reformist journalists writing for the Shargh Daily in Tehran argue the partial restoration is more significant than Western monitors acknowledge: the Chinese DPI system requires centralised permission signals to block at the regional level, and Pezeshkian forcing even a partial permission change shows the presidency can override specific regional blocks, even if it cannot disable the hardware.

Shargh commentary frames the move as a deliberate signal to Washington and to Iran's urban professional class that the civilian government is willing to pay a domestic cost for diplomatic optics.

Key tension: Whether the IRGC will accept the partial lift as a bounded concession from the presidency, or whether it will reverse the order once the diplomatic utility (signalling flexibility in Doha talks) has been extracted.

Sources:Hasht-e Subh

Mentions:Masoud Pezeshkian →NetBlocks →Islamic Revolutionary Guard Corps (IRGC) →Iran →China →Tehran →Freedom House →Beijing →Toronto →Doha →Ali Shamkhani →Washington →Deep Packet Inspection →Xinjiang →House of Representatives →WhatsApp →

First Reported In

Update #109 · War Powers clock outlasts Congress by a day

Hasht-e Subh· 27 May 2026

Read original →

Causes and effects

Caused by

Three internet tiers, one negotiating line

The 87-day internet blackout documented as the longest in modern record (ID:3498) is the event Pezeshkian's 25 May order ends, advancing from the prior cost-documentation beat.

Occurred 20 May 2026

Read story →

Iran buys China's internet control dial

Chinese DPI hardware installed (ID:3617) is why restoration is only partial — Pezeshkian can flip the public switch but not the underlying security-state infrastructure.

Occurred 23 May 2026

Read story →

This Event

Iran lifts record blackout, 2,093 hours

The order maps the exact boundary of civilian authority in Iran's wartime state: the president can flip the public switch but not touch the IRGC's filtering hardware beneath it.

Led to

Iran's internet returns at 40%, by design

Pezeshkian's 25 May restoration order was the direct cause of the 28 May partial-recovery measurement; the 40% figure is the outcome of that order.

Occurred 28 May 2026

Read story →

Different Perspectives

Hengaw and Iranian protest detainees

Hengaw documented three secret executions of protest-linked detainees at Isfahan and Karaj on 15 and 16 July, including Mohammad Amini Dehaghani, hanged over a January arson charge with no public trial record. Tehran is carrying out capital punishment against 2026 protesters while global attention stays fixed on the war with the US.

Russia

OFAC named Moscow aviation firm Avratek OOO and its principals Mariya Selina and Vadim Druzhbin directly for the first time in this war's Iran arms track, under an Executive Order 13382 designation issued 15 July. The designation converts years of rhetorical claims about Russian arms supply to Iran into named, sanctionable individuals and a documented company.

Bahrain

Bahrain sounded air-raid sirens during Iran's 14 July Gulf-wide barrage and was struck again in the 16 July Artesh claim against Sheikh Isa air base, home to the US Fifth Fleet. Manama's air-defence stocks were already reported near-exhausted before this second strike claim against the same base in a week.

Kuwait

Kuwait's armed forces intercepted the drones Iran's Army claimed against Ali Al Salem air base on 16 July and separately reported intercepting missiles and drones in Iran's Gulf-wide barrage on 14 July. Kuwait now absorbs strikes from two rival Iranian commands while hosting Camp Arifjan, the US logistics base Iran also claims to have destroyed.

Iran (Artesh and IRGC)

Iran's regular Army claimed the 16 July drone strikes on Kuwait's Ali Al Salem and Bahrain's Sheikh Isa air bases under its own banner, Operation Saeqeh phase ten, while the IRGC separately claimed a mine strike closing Hormuz on 18 July. Two Iranian institutions are now claiming parallel operations, with neither claim confirmed by Kuwait, Bahrain or CENTCOM.

United States

CENTCOM bombed the interior cities of Ahvaz and Yazd for the first time overnight into 17 July, Marines began boarding vessels including the tanker Wen Yao, and Treasury let General License X1 lapse at 12:01am the same day. Washington closed every remaining channel for de-escalation without a new executive action, a posture of attrition rather than a wind-down.