- Iran’s regime has long practiced surveillance of its own population to prevent and repress domestic dissent, as well as of the Iranian diaspora to limit opposition activity abroad.
- Tehran commands a broad surveillance toolkit ranging from classic human informant networks to CCTV-based facial recognition and identification systems, online citizen reporting, and digital monitoring tools. China and Russia provided parts of its toolkit under long-term partnerships.
- The war has made regime survival paramount. This has erased boundaries between domestic dissent, infiltration/espionage and foreign pressure to the effect that any kind of perceived disloyalty can now result in threats, imprisonment or execution.
- The cost of Iran’s surveillance state is economic, political and social as the authorities must pay for an extensive security apparatus, deal with the pretence of compliant behaviour and must harness an increasingly distrustful society to its political aims.
By Mina Shahmiri, Lecturer and PhD Candidate at the Corvinus University of Budapest
Editor’s introduction
In September 2022, the death of Mahsa Jina Amini marked a major turning point for Iran. The event sparked lengthy nationwide protests across socio-economic classes and population groups whose demands rapidly evolved from discarding controversial hijab regulations to calls for the overthrow of the Islamic Republic. The Iranian government responded with repression, killing over 400 protesters in late 2022 and early 2023, according to human rights groups. The protests of January 2026 reflected the same public discontent and reinforced the negative spiral of government underperformance and decreasing popular legitimacy. They also increased the external and internal pressures on Iran’s government compared with the protests of 2022/2023.
The Clingendael blog series ‘Iran in transition‘ explores power dynamics in four critical dimensions that have shaped the country’s transformation since 2022: state-society relations, intra-elite dynamics, the economy, and foreign relations. This blog analyses the role, dynamics and cost of surveillance in the Islamic Republic before and after recent US-Israeli assaults against the country.
The context of surveillance in Iran
Surveillance is a core component of the Islamic Republic’s coercive architecture. It has the advantage of making repression invisible, at least in part. Once monitoring is built into ordinary institutions, control becomes routine and its effects become preventive. Self-censorship deters opposition before it becomes politically visible and reduces the need for overt coercion. Episodes of protest, unrest and insecurity have repeatedly pushed the authorities to make iransurveillance more effective by refining their tools and improving their tactics. What emerges today is a wartime upgrade of Iran’s monitoring practices in response to the security pressures created by the joint U.S. and Israeli attacks on Iran since 28 February 2026. Practically, the regime has added new layers to its already multifaceted system of surveillance and digital repression, which are discussed below, with the result that its reach is expanding.
The Islamic Republic entered the war under the stressors of recurring protests at ever shorter intervals. Over the preceding decades, waves of protest exposed the growing strains in state–society relations and the erosion of public trust in the authorities. For the regime, the possibility of mass mobilization has become a permanent concern, especially since repeated crackdowns have not prevented their recurrence. Each new round of confrontation has raised the stakes. Demonstrations abroad have also put the diaspora opposition on Tehran’s radar and pushed both monitoring and repression of political activity outside of Iran higher up its security agenda.
The January 2026 protests left the regime deeply wary of further unrest at home. Once the war began, that fear was amplified by open calls from Washington and Israel for political change inside Iran, as well as reports that the United States was considering support for Iranian Kurdish groups fighting the government. Trump urged Iranians to rise up, while Netanyahu called on them to “join forces” and topple the regime. For Tehran, this rendered the line between domestic dissent and suspected foreign collaboration near-irrelevant. The judiciary made clear how far the state was prepared to go: there would be “no mercy for infiltrators, mercenaries, or traitors who cooperate with the enemy” and such labels would just as readily be applied to domestic dissidents in times of war. The mere allegation of spying or collaboration with the enemy can now result in punishments such as confiscation of assets, torture and execution. Suppressing any foreign-fed dissent made surveillance ever more important and expanded it further upstream.
Surveillance before the war
Political surveillance in authoritarian states is never the work of the state alone. Iran is no exception. The Islamic Republic has long relied on a range of institutions to watch, report and control its citizens. Perhaps nowhere is this more visible than in Herasat, a system that publicly monitors people in civilian and state institutions. For generations of Iranians, it has long been associated with being monitored for crossing political or social lines set by the regime. But behind it sits a much larger security apparatus: the Ministry of Intelligence (MOIS), the IRGC, the police and the Basij, which all conduct surveillance. Together, they form a decentralized but politically connected system that has multiple eyes on society at the same time. The 2022 protests showed this coordination in practice. The IRGC, Basij and police acted through national and provincial security councils based on centrally issued and shared orders, as well as deployment plans, that directed the crackdown. These institutions also maintain direct channels that citizens can use to report suspicious or unlawful behavior. For decades, MOIS has run its 113 hotline while the Intelligence Organization of the IRGC set up its own 114 hotline for reporting suspicious activity.
When the internet became part of everyday life, the state moved to bring it under control via surveillance. The 2009 Green Movement was the first major nationwide protest in which social media played an important role. The protesters became the target of the website of the IRGC’s Cybersecurity Command called Gerdab (‘vortex’) that published their photographs and asked the public to help identify them. In the following years, internet control became more systematic with filtering, online monitoring, and slowing or shutting down access during unrest. By the time of the Woman, Life, Freedom protests in 2022, the authorities had developed SIAM, a potent mobile-surveillance systems that can identify, track and profile protesters.
However, surveillance goes beyond periods of protest. It has become a routine element of enforcement with compulsory hijab wearing having become one of its clearest testing grounds. The shift was visible even in official rhetoric as policing was linked to ‘smart’ identification. Cameras, facial recognition, SMS warnings and reporting apps give the state several ways to identify individuals, link behavior to a name or location, and follow up with warnings, summons or punishments. For example, the surveillance tool Nazer (‘observer’) consists of four apps that allow police and vetted volunteer civilian hijab enforcers to monitor and report women in cars, public places and parks, as well as their online activity. By 2025, Tehran was expanding both the technological and human reach of surveillance: the municipality announced 15,000 additional video-surveillance cameras, while authorities reportedly trained 80,000 hijab enforcers. The scale is evident in public data: just during the Iranian New Year holiday, the authorities issued over 97,500 public warnings for compulsory-hijab violations in a single city. By the time war began, a formidable surveillance infrastructure was already in place.
War, infiltration and the expansion of surveillance
The war began with Iran’s surveillance systems being hacked and used against its leadership. Tehran’s vast camera network had reportedly been compromised for years and exploited by Israeli intelligence to track Ayatollah Ali Khamenei’s movements before he was killed on 28 February. That same day, Iran began what would become the longest nationwide internet shutdown in its history: 88 days. Internet blackouts were common for years during crises to limit communication and restrict the flow of information. This time, however, the shutdown forced most of the population offline as the regime tightened its grip on the information space. This digital isolation made people less visible to one another and to the outside world. The blackout did not leave the state blind, however. Iran had already acquired facial-recognition technology capable of processing stored CCTV footage and images offline, meaning that identification did not have to happen in real time. In addition to the internet blackout, Iran’s government took several further initiatives to control the public and digital space.
To begin with, the war brought surveillance back to the street in a much more physical form. Police said they had established 1,463 special checkpoints across the country, backed by nearly 15,000 patrols and more than 129,000 personnel working around the clock, while Basij forces have maintained a street presence since the war began.
Moreover, the war deepened the regime’s repressive domestic counterintelligence practices. Amnesty International and Human Rights Watch documented security forces searching passengers’ phones for footage from the January protests, social-media posts and contacts that could evidence collaboration with the enemy. Within weeks, photographing and sharing strike sites became an offense. MOIS called those sending images abroad ‘the eyes’ of Israel, and IRGC Intelligence described such acts as “cooperation with the enemy”. In the early days of war, some inhabitants of Tehran received SMS warnings saying they had been identified as likely participants in “illegal unrest”. Nearly six months into the war, in August 2026, Iranian parliament approved the outlines of a proposed law to counter foreign infiltration. Among other things, this bill enabled closer scrutiny of Iranians in contact with foreign media, universities, embassies and other organizations, with some instances requiring prior approval if criminalization is to be avoided. The proposal was controversial even within the establishment. For example, the Pezeshkian government publicly opposed it while the judiciary objected that it had not been consulted during the process of legislative drafting.
Digital surveillance also deepened during the war. In September 2026, Iranian state television promoted a new platform called Alaj (‘cure’). Its operators describe their targets as ‘traitors abroad’ and say they will continuously monitor people they deem “anti-Iranian” – for example those that support sanctions or military action. Users are asked to supply missing details such as addresses, jobs, social-media accounts and family connections. Alaj has subsequently threatened targets with the loss of civil privileges, confiscation of property, and restrictions on their finances and communications access inside Iran. The tool claims to hold information on around 1,600 people, including roughly 600 profiles that are built from public reports. This progression is notable: over a decade ago Gerdab asked citizens to put a name to a face; Nazer links observation to an identifiable person; and now Alaj asks the crowd to help construct the profile itself. The shift is from identifying people to reporting their behavior and then helping to build profiles. The result is a form of surveillance in which the state does not need to observe every interaction directly. It can recruit the eyes, phones and personal knowledge of citizens themselves.
Finally, the Islamic Republic expanded its use of cyber operations to extend surveillance beyond its physical borders. A recent report by the UK National Cyber Security Center, the FBI and the Netherlands’ General Intelligence and Security Service shows that Iranian state-linked actors compromised the devices of dissidents, activists and journalists abroad to access their communications, contacts, locations and patterns of daily activity. By using malware to penetrate personal devices, the regime has effectively turned cyber intrusion into a tool of surveillance. Another report in July 2026 found that Iranian state-linked actors were using malware disguised as fake VPN and media-player apps to infect the devices of Iranians inside the country and opposition networks abroad. Once installed, the malware gives operators access to the device, turning everyday apps into monitoring tools. AI is adding another layer to such capabilities. In September 2026, US AI giant Anthropic revealed that two units linked to Iranian security bodies were using their language model, Claude, to build surveillance tools for profiling individuals such as members of the opposition and diaspora based on their social media activities. AI presumably also makes such profiling faster.
Foreign technology and authoritarian learning
The rapid upgrading of Iran’s surveillance capabilities raises the question as to where some of these ideas, technologies and practices come from. For authoritarian regimes, surveillance is closely tied to regime survival, and cooperation with other autocracies can provide both models and capabilities for managing threats at home. Iran’s partnership with countries such as China and Russia not only helps it to circumvent sanctions and improve military capabilities but also offers the opportunity to learn from their experience in maintaining a compliant social order and suppressing dissent. Chinese support has played a significant role in expanding Iran’s surveillance and censorship capacity since at least 2010. Chinese firms such as ZTE, Huawei, Tiandy and Hikvision have supplied systems and equipment such as CCTV monitoring infrastructure, online filtering and controlling internet access. Several of these companies have faced US sanctions, export restrictions and even legal action over links to surveillance, human-rights abuses or sanctions violations in Iran. Yet this has not prevented further cooperation. The 25-year cooperation plan signed in 2021 covered technology and communications as well. Beyond buying technologies, Iran also borrowed from China’s model of digital authoritarianism such as the notion of cyber sovereignty via centralized internet control, a Great Firewall, and cyber-governance institutions.
Russian assistance to Iran’s domestic surveillance system has been formalized through bilateral agreements that date back to 2021. The 2025 Partnership Treaty built on this cooperation and was put in place before the Israeli/American attacks on Iran. This suggests that the surveillance build-up was already underway and the war simply changed how these capabilities were used. Similar to the partnership with China, Iran’s 20-year partnership treaty with Russia includes the supply and sharing of (surveillance) technologies and digital development. In this context, Iran reportedly acquired Russia’s FindFace, an AI-powered facial-recognition technology, which can identify and track individuals through camera networks.
The consequences of a ‘surveillance society’
Surveillance and security are two sides of the same coin for Tehran. The regime has always justified greater control in the name of sovereignty and stability. War has accentuated its central fear of losing control to such an extent that dissent, infiltration and external pressure are no longer treated as separate threats. Regime survival is paramount.
Yet, increased surveillance does carry economic, political and social cost. Economically, surveillance is expensive when the economy is already battered by sanctions, inflation and war. On the one hand, there is the direct cost of employing a large apparatus of security personnel and informants, as well as the purchase and maintenance of surveillance technology and applications. On the other hand, there is the indirect economic cost of specific interventions. For example, the 2026 internet shutdown cost Iranian businesses as much as $80 million a day.
Politically, the more people conceal their real views, the harder it becomes for the regime to know where grievances are building, what the public sentiment is, and when frustration may be approaching a tipping point. This is what is known as the dictator’s dilemma, i.e. tighter control makes society harder to read. This creates two possible trajectories for political unrest. If surveillance continues to expand and optimize, the regime may become more capable of disrupting mobilization before it gathers momentum. But intense surveillance can also push sentiments so deep below the surface that once they erupt, they will be much harder to contain.
Socially, decades of surveillance have a chilling effect by creating a culture in which people anticipate scrutiny, adjust their behavior and sometimes monitor one another. Surveillance corrodes the trust that holds society together. Iran’s informant system deliberately erodes trust by making ordinary relationships potential channels of surveillance. For the regime, mistrust has value because it weakens solidarity, makes collective action such as demonstrations harder and encourages self-censorship. But the regime still needs the cooperation of Iran’s population in other areas once the guns fall silent again. That will become harder.