Iran: Parliament’s “Protection Bill” will Hand Over Complete Control of the Internet to Authorities
(Part of ARTICLE 19’s Tightening the net series)
Iran’s Parliament is poised to pass a Bill within the next two months that will deal a devastating blow to the rights to freedom of expression online and the privacy of internet users. The “Cyberspace Users Rights Protection and Regulation of Key Online Services”[1], widely referred to as the “Protection Bill” (hereafter ‘the Bill”), or in Persian as Tarh-e Sianat (طرح صیانت) will disrupt access to international services, seriously threaten net neutrality and would place control over Iran’s Internet infrastructure, and most importantly Internet gateways, in the hands of the armed forces and security agencies. This is an alarming development in a country where Internet shutdowns and other methods of preventing access to the Internet are becoming a commonplace method of stifling dissent.
“Using the term ‘Protection’ to name this legislation will not detract from the fact that Iran’s Parliamentarians are launching a full-on attack on people’s rights to freedom of expression, access to information and privacy.” said Saloua Ghazouani, Director of ARTICLE 19 Middle East and North Africa Programme. “The Bill, if implemented in its current form, will potentially lead to a blanket ban against all international online services, effectively placing the people of Iran in an information blackhole where accessing even basic services such as email and messaging tools will not be possible.”
The Bill is being railroaded through Parliament using a procedure that will prevent the Bill from being put to a vote. On 28 July, MPs voted[2] for the Bill to be reviewed by a specialised committee and experimentally implemented for three to five years (or even longer) pending a final ratification by Parliament under Article 85 of the Islamic Republic’s Constitution. The review by the specialised committee will only take two months.
ARTICLE 19 urges Iran’s Parliamentarians to immediately withdraw the proposed Bill, to refrain from introducing similar initiatives, and to introduce legislation that would guarantee meaningful access to an open and secure Internet and protect the right to privacy of Internet users in Iran.
Foreign Internet services required to comply or face censorship
The Bill requires international tech companies to have a legal representative in Iran to comply with Iranian laws, and cooperate with the Iranian government in surveilling users and censoring online spaces. Refusal to comply will result in two censorship techniques: initially, throttling and once the local alternative in the National Information Network (NIN) is developed, full blocking. In practice, however, international tech companies, especially firms with ties to the US, will legally be unable to accept these demands, due to the far-reaching US sanctions regime in place against the Islamic Republic of Iran.
In the unlikely event that international tech companies that do not have entities or business with or within the United States collaborate, there will be severe repercussions for all internet users in Iran. This is particularly true for members of civil society and marginalised groups who are regularly targeted by the state in monitoring and surveillance operations. Concerns for internet users are further heightened in light of Iran’s domestic laws which fail to comply with international human rights law. Numerous provisions of the Islamic Penal Code criminalise the exercise of human rights through vaguely worded and broadly defined “offences” such as “spreading propaganda against the system”, “insulting Islamic sanctities”, and “insulting the Supreme Leader.” These provisions are frequently used to stifle all dissenting voices, and with the Protection Bill they will be applied extensively to private conversation and a variety of private activities online.
The Bill provides that platforms that refuse to cooperate with the government’s demands will be subject to bandwidth throttling[3] until such time as domestic alternatives are created and are expected to be then censored entirely, pushing users onto the Iranian platforms on the NIN . This marks a significant shift for censorship within the Islamic Republic, where “throttling” has previously been implemented but had never been officially acknowledged as government policy up until now.
Over the past few months, for example, access to three major social media platforms and instant messaging services, namely WhatsApp, Instagram and Clubhouse[4], have been disrupted in Iran using this technique.
Strengthening the National Information Network: Pushing Users into Controlled Domestic Services
The Bill will also push users in Iran to use local services or international services that comply with local laws by setting a limit for the share of bandwidth international services can use. It has been a long-term project of the Islamic Republic of Iran to create a NIN. Internet infrastructure and services are localised within the NIN and can potentially assist in the shutting down of international traffic, while national Internet services on the NIN remain online. This bandwidth limit will be set by the Supreme Regulatory Commission (SRC)[5], an entity tightly controlled by the Supreme Leader, Ali Khamenei.
The Bill also allocates a fund and government agency known as the “Fund for Supporting Local Key Online Services” under Article 13, which operates under the SRC. The fund will be responsible for developing Key Online Services, promoting the public’s “digital literacy”, monitoring and reporting on Key Online Services, supporting tools for “purifying” and protecting cyberspace, developing “pure services, especially for children and teenagers”, supporting local content production in line with “Iranian-Islamic values”, and supporting “cybercrime prevention techniques”.
ARTICLE19 is particularly concerned by the terminology used to describe the Fund’s activities. These descriptions indicate heavy investment in the implementation of censorship and surveillance tools, and provide no guarantees that promotion and creation of “pure content” won’t be used as online propaganda and influence campaigns, similar to other existing efforts being led by other organisations such as the Supreme Leader controlled Islamic Development Organisation.
Banning Circumvention Tools and Introducing Government Controlled Tiered VPNs
The Bill also criminalises the production and distribution of censorship circumvention tools. Circumvention tools are ubiquitous in Iran and widely used to access most foreign Internet services and websites, which are otherwise blocked by the authorities. The Bill punishes the production, sale and distribution of censorship circumvention tools (e.g. virtual private networks, ‘VPNs’, and proxy services) with imprisonment of up to two years.
Furthermore, the Bill provides for the introduction of “legal VPNs” in Article 4. ARTICLE 19 is concerned that in the context of ongoing discussions by policymakers for introducing a tiered system of VPN access,the draft’s language on introducing legal VPNs through the oversight of the SRC will possibly lead to indirect discrimination. Without providing clarity on the purposes and criteria that justifies the need to create categories for access, the system may result in ranking people based on their age and profession, effectively creating different classes of people and providing them with varying levels of access to the Internet on this basis.’ We recall that Iran is bound, both under its domestic laws as well as international law and standards to ensure the right of all to equality. Iran’s Constitution guarantees the right to equality, albeit in a flawed manner. Moreover, the right to equality is enshrined in Article 7 of the Universal Declaration of Human Rights, which has the status of customary international law, as well as multiple treaties to which Iran is a state party including the International Covenant on Civil and Political Rights.
Prohibiting Online Anonymity and Further Eroding Privacy Rights
The Iranian parliament has also targeted online anonymity in the Bill. Under Article 25, service providers will be required to only allow users to sign up for services using their legal identity. Service providers will be required to collect users’ data, which is described as “electronic evidence”, and hand it over to the authorities upon request.
Online anonymity is an essential tool for individuals exercising their right to freedom of expression online, including civil society, activists, human rights defenders, journalists and marginalised groups to stay safe online and evade state persecution in oppressive environments like Iran. The requirements under the Bill are in breach of international standards on freedom of expression and privacy and inconsistent with the recommendations of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression in his 2015 report (A/HRC/29/32) to the Human Rights Council.
Internet Infrastructure Handed Over to Armed Forces and Security Agencies
Under the Bill, control over key communication infrastructure, namely international gateways, the infrastructure connecting Iran to the Internet, will be delegated to an ad hoc agency controlled by the armed forces and security agencies. Delegating this level of control over Iranians’ Internet and communications access to entities that lack transparency and accountability is deeply concerning. The move will make implementation of Internet shutdowns and online censorship extremely easy and opaque.
The Bill will also bar the private sector from providing bandwidth in Iran, further centralising Iran’s communication network. This is almost certain to discourage private investment in communications infrastructure and services, and to intensify digital disparity between Iran and other countries. Further centralisation of communication infrastructure will also make implementation of censorship policies easier.
Timeline for Implementation of the Bill
Since the announcement by Parliament of its plans to pass the Bill under Article 85, there has been a major public outcry by human rights defenders, journalists, human rights organisations and Internet users whose rights will be further restricted should the Bill pass into law.
The Article 85 provision used for its passage delegates the decision over the implementation of the Bill to a small group of MPs working behind closed doors. This curbs accountability and threatens transparency. According to the Parliament Research Centre, an advisory arm of the parliament, a specialised committee of MPs will review the Bill for the next two months with help from “experts, prominent online figures, and representatives from the government and the private sector.” After the two-month period, the reviewed Bill will be referred to a Parliament open session. During the session, it will be determined for how long the Bill should be implemented “experimentally”, and then it will be sent to the Guardian Council to be ratified. The Guardian Council is Iran’s constitutional watchdog, composed of six Islamic jurists appointed by the Supreme Leader and six lawyers nominated by the Head of the Judiciary. The Council will examine the compatibility of the legislation passed by the Parliament with existing Islamic laws and the Constitution, and has veto power over it. Given the Guardian Council’s track record in approving legislation that impinge on human rights and objecting to more progressive one, it is largely expected that the Bill will be well received by the Council.
ARTICLE 19 is very concerned by the aggressive push to pass and implement this Bill and Parliament’s utter disregard for the rights of every part of Iranian society. This Bill must not be enacted.
ARTICLE19’s Recommendations
Recommendations to the government of Islamic Republic of Iran:
- The Islamic Republic of Iran must immediately withdraw the “Cyberspace Users Rights Protection and Regulation of Key Online Services” in its entirety and refrain from introducing similar legislation in the future.
- All governing institutions of Islamic Republic of Iran must immediately stop all plans that would cut its people off from, or limit their access to an open and free global Internet.
- All governing institutions of the Islamic Republic of Iran must stop the blocking and filtering of online content under the justification of ‘national’, ‘clean’, ‘pure’, or ‘halal’
- All governing institutions of Islamic Republic of Iran must respect the online privacy and anonymity of its people and immediately stop subjecting them to unlawful surveillance. Any surveillance conducted by states must be in strict adherence to Article 17 of the International Covenant on Civil and Political Rights.
- ARTICLE19 reiterates its previous calls for the Islamic Republic to reform it’s Constitutional provisions to protect freedom of expression, and to repeal or substantially amend provisions within the Islamic Penal Code as well as the existing Computer Crimes Law that restrict the right to freedom of expression.
Recommendations to the International Community:
- Iran’s trade partners and especially those who have partnership with the country’s Ministry of Information Communication and Technology (ICT) or ICT sector must condition cooperation and partnership on the withdrawal of this Bill;
- The European Union must condition bilateral economic ties to Iran on its respect for human rights and to the repeal or withdrawal of bills that violate them, including the Protection Bill. The European Union must urge Iran to seek GDPR adequacy provisions to enter into ICT trade partnerships with the EU;
- The International Telecommunications Union must condemn this Bill and all efforts to shutdown and limit access to the global Internet by member states;
- UN mandate holders on the situation of freedom of expression, privacy and human rights in Iran must send an urgent communication to the Iranian authorities reminding them of their international human rights obligations and urging them to align the country’s domestic legislation accordingly.
ARTICLE19 will be publishing a full legal analysis of the bill in the coming weeks.
[1] The last publicly available iteration of the bill, published on the website of the Iran Parliament Research Centre, is dated 17 July 2021 can be found here: “Response to some questions on bill titled ‘The Cyberspace Users Rights Protection and Regulation of Key Online Services’,” Iran Parliament Research Centre, July 29, 2021, https://rc.majlis.ir/fa/news/show/1667800 (attachment of the latest draft is imbedded in the parliamentary Q&A page)
[2] 121 for, 74 against and nine abstentions
[3] Bandwidth throttling is intentionally disrupting access to Internet platforms to slow them down to become difficult to impossible to use, especially for uses that require more Internet data, such as sharing photos, voices notes, videos, or calls.
[4] Iranian network monitoring tool ArvanCloud Radar has recorded recurring disruptions in access to Instagram and Clubhouse. https://radar.arvancloud.com/
[5] The Supreme Regulatory Commission is an arm of the Supreme Council of Cyberspace (SCC). The Bill, if ratified into law either permanently or temporarily, would delegate responsibilities and powers to SRC that overlap with legal responsibilities of the Ministry of Information and Communications Technology (ICT), the Committee Charged with Determining Offensive Content (CCDOC), and even Supreme Council of Cyberspace itself. From the 18 voting members of the SRC, 12 are direct or indirect appointees of the Supreme Leader. Five are representatives of Islamic Republic security agencies and armed forces.