PART I: THE ARCHITECTURE OF REPRESSION, COURTS, EXECUTIONS, SECURITY FORCES, WOMEN AND ETHNIC MINORITIES
Iran’s Repression System Is No Longer Confined to the Street
The human-rights crisis in Iran during 2025 and 2026 cannot be understood simply as a series of arrests, executions or isolated clashes between protesters and police. The available evidence points instead to an interconnected system involving the Revolutionary Courts, ordinary criminal courts, prisons, the Islamic Revolutionary Guard Corps, the Basij, the Law Enforcement Command of the Islamic Republic of Iran, commonly known as FARAJA, the Ministry of Intelligence, the IRGC Intelligence Organization, state-controlled telecommunications infrastructure and increasingly sophisticated digital-surveillance mechanisms.
Human Rights Watch reported that by the end of 2025 Iranian authorities had carried out more than 2,000 executions, the highest known annual total in decades. It also documented entrenched discrimination against women and girls, ethnic and religious minorities, political dissidents and human-rights defenders.
The scale of repression expanded dramatically following the nationwide protests that began on December 28, 2025. Human Rights Watch reported that protests spread from Tehran's Grand Bazaar to at least 27 provinces and were met with lethal force, mass detention and escalating state violence.
The Death Penalty as an Instrument of State Power
Iran remained one of the world's most prolific users of capital punishment. Independent human-rights monitors continued to document hundreds of executions during 2026, including women, protesters, political prisoners, drug offenders and defendants convicted in national-security cases.
Human-rights organizations repeatedly raised concerns about access to counsel, coerced confessions, closed judicial proceedings, vaguely defined national-security offences and death sentences imposed after trials that did not meet international fair-trial standards.
No reliable public source provides a complete national total for every person presently under sentence of death in Iran. Any exact nationwide figure would therefore create false precision unless based on comprehensive judicial records that remain unavailable to the public.
The more reliable method is to distinguish between confirmed death sentences, defendants facing capital charges, prisoners whose sentences remain under review and individuals assessed by human-rights organizations as being at imminent risk of execution.
The January 2026 uprising substantially expanded this group. Human-rights organizations reported that protesters faced charges including moharebeh, or “enmity against God,” an offence that can carry the death penalty. Human Rights Watch warned during the January crackdown that detained protesters could face secret and arbitrary executions.
The December 2025 to January 2026 Uprising
Nationwide protests began on December 28, 2025 amid severe economic pressure, deteriorating living standards, currency instability and broader dissatisfaction with the political system.
Human Rights Watch reported that at least 27 protesters and bystanders, including children, had been killed within the first days, while demonstrations spread across at least 27 provinces.
After January 8, the scale of repression changed dramatically.
Human Rights Watch reported growing evidence that Iranian security forces carried out coordinated mass killings across the country. The organization reviewed videos, photographs and witness accounts showing protesters and bystanders with gunshot injuries to their heads and torsos. It reported that thousands were believed to have been killed, while acknowledging that the blackout made precise verification extraordinarily difficult.
The communications blackout imposed at the same time was not peripheral to the crackdown. It became part of the operational environment in which that crackdown occurred.
Human Rights Watch stated that the nationwide internet shutdown severely hindered documentation of killings and other violations and concealed the scale of atrocities.
Mass Arrest, Enforced Disappearance and Coerced Confessions
After the major January killings, repression continued through detention and judicial mechanisms.
Human-rights organizations documented arbitrary arrest, incommunicado detention, enforced disappearance, allegations of torture and forced confessions. Security institutions implicated in the broader repression included FARAJA, the IRGC, the IRGC Intelligence Organization, the Ministry of Intelligence, prosecutors and judicial authorities.
The importance of this system lies in its continuity:
Street repression, arrest, intelligence interrogation, coerced confession, prosecutorial action, Revolutionary Court proceedings, imprisonment or execution.
These stages should not be treated as disconnected events. In practice, they can form a continuous enforcement chain.
Women Under a Hybrid System of Physical and Digital Enforcement
Women and girls continued to face structural discrimination in family law, marriage, divorce, inheritance, custody and compulsory-hijab enforcement.
At the same time, enforcement increasingly combined physical policing with automated surveillance.
A surveillance camera can identify a vehicle, facial-recognition systems can identify individuals, SIM registration can connect a mobile device to a legal identity, financial data can connect that identity to purchases, while location and telecommunications data can reconstruct movement.
The significance of this architecture is that repression no longer requires a police officer to physically confront every individual. Digital infrastructure can expand enforcement continuously and remotely.
In August 2025, the U.S. Treasury sanctioned FANAP and associated entities in an action targeting Iranian surveillance and technology networks. Treasury described FANAP-linked companies as involved in technologies connected to surveillance, communications control and the National Information Network.
Ethnic and Religious Minorities
The burden of repression has not been distributed evenly.
Human-rights organizations have repeatedly documented discrimination and disproportionate state violence affecting Kurds, Baluch communities, Ahwazi Arabs, Azerbaijani Turks, Turkmen and religious minorities including Baha'is.
Minority-populated border regions have been especially vulnerable to lethal enforcement, economic marginalization and heavy security presence.
Kurdish kulbars and Baluch soukhtbars have repeatedly faced lethal force from Iranian security personnel.
The absence of transparent state reporting makes precise demographic execution rates difficult to establish, but independent organizations have repeatedly documented a substantial presence of Kurdish and Baluch prisoners among execution cases.
The resulting structure is therefore not merely one of nationwide authoritarian repression. It is layered repression in which political activity, ethnicity, religion, gender, geography and economic status can significantly alter exposure to detention, surveillance or lethal force.
PART II: WEAPONIZING CONNECTIVITY, DPI, ROUTING CONTROL, WHITELISTING, PHYSICAL NETWORKS AND FOREIGN TECHNOLOGY
Iran Did Not Simply Turn Off the Internet
The censorship architecture visible in Iran during 2025 and 2026 can no longer be accurately described as a list of blocked websites.
Iran developed the capacity to interfere with communications at multiple layers:
International routing, DNS resolution, mobile access, subscriber identity, VPN detection, protocol filtering, TCP and UDP behavior, domestic hosting, data centers, international gateways, National Information Network access and whitelisting.
The technical significance is considerable.
A state does not necessarily need to decrypt a message if it can prevent the encrypted connection from being created or maintained.
The January 8, 2026 Blackout
Filterwatch described the January 2026 shutdown as the most comprehensive and sophisticated communications blackout observed in Iran's history.
Beginning January 8, access to the global internet was severed. The disruption extended beyond international websites and affected parts of the National Information Network, domestic digital services and telephone connectivity.
Filterwatch recorded a large reduction in announced IPv6 address space before the full shutdown and interpreted this as evidence that infrastructure-level preparations preceded the nationwide cutoff.
As connectivity gradually returned, Iran did not simply restore the previous internet.
Filterwatch documented a shift toward a whitelisted model, in which international access was blocked by default while selected authorized services could operate.
The distinction is fundamental.
Blacklist model: the internet is available except for what the state blocks.
Whitelist model: the internet is unavailable except for what the state authorizes.
This is not simply stronger censorship. It is a different governing architecture.
Internet Pro and Privileged Connectivity
Reuters reported in April 2026 that Iranian authorities had introduced a temporary program known as Internet Pro, giving selected businesses less-restricted access while the broader population remained under severe limitations.
Such a system has implications beyond access.
If privileged connectivity is tied to verified SIM cards, corporate identities, named employees, approved institutions or state authorization, then access can become directly attributable to particular users.
Connectivity therefore becomes both permission and identity.
Prolonged Isolation
Internet restrictions imposed again on February 28 continued for months. Human Rights Watch reported a nationwide traffic collapse after February 28 and warned that continuing shutdowns endangered civilians.
This demonstrates that censorship does not need to operate as a simple binary choice between “on” and “off.”
A network can remain connected but unusable, connected but throttled, available only domestically, available only to selected users, available only through approved applications, or technically routable while most useful traffic is filtered.
Technical Analysis of DPI and Protocol Neutralization
Deep Packet Inspection, or DPI, is often misunderstood as technology that simply reads encrypted content.
That is not necessary for many censorship functions.
Encrypted traffic still reveals characteristics that can be analyzed.
Depending on deployment and protocol, filtering infrastructure may examine destination IP, source IP, ports, DNS behavior, TLS handshake characteristics, TLS fingerprints, exposed Server Name Indication, certificate attributes, QUIC behavior, UDP behavior, packet timing, packet size, connection duration, retry patterns, known VPN endpoints, known proxy addresses and traffic-flow signatures.
A filtering system may then respond by dropping packets, blocking IP ranges, interfering with DNS, degrading bandwidth, blocking UDP, terminating TCP sessions, resetting connections, blocking known VPN infrastructure or actively probing suspected circumvention servers.
For the ordinary user, the practical result can resemble decryption because the application simply stops working.
WireGuard, OpenVPN and Other Encrypted Circumvention Tools
VPN protocols such as WireGuard and OpenVPN protect content but may still generate recognizable network characteristics.
Traffic-classification systems can attempt to identify them through handshake patterns, endpoint reputation, flow behavior and packet characteristics.
This creates a continuing technical contest.
Circumvention developers attempt to make prohibited traffic resemble ordinary traffic; filtering systems attempt to distinguish circumvention traffic from permitted traffic.
The objective of censorship is therefore not always to read a message. Sometimes it is sufficient to make communication unreliable or impossible.
Chinese Technology and Iran's Surveillance Infrastructure
Iran's surveillance and censorship infrastructure is not entirely domestically manufactured.
Telecommunications networks depend on globally manufactured routers, processors, optical equipment, switches, software and monitoring systems.
Open-source investigations have examined Chinese companies including ZTE, Huawei, Tiandy Technologies and Hikvision in connection with historical Iranian telecommunications and surveillance infrastructure.
The importance of these relationships is not limited to individual pieces of hardware.
Imported telecommunications components can be combined with Iranian databases, domestic software, subscriber information, local data centers and government-controlled network infrastructure.
The Russian Technology Connection: PROTEI
Citizen Lab investigated leaked commercial documents concerning Iranian mobile operator Ariantel and several international telecommunications vendors.
The documents indicated that PROTEI, a telecommunications company founded in Russia, had been selected to provide technology supporting subscriber authentication, data management, mobile signaling, SMS services and Deep Packet Inspection.
Citizen Lab also reviewed a PROTEI DPI acceptance-testing document related to the Iranian project.
The significance is clear. Foreign-origin technology can become integrated into a domestic censorship architecture even when operational control remains Iranian.
The China, Russia and Iran Technology Triangle
China, Russia and Iran maintain significant security and technology relationships.
The evidence supports separate conclusions for each.
China: significant telecommunications manufacturing capacity and documented historical technology relationships relevant to Iranian communications and surveillance systems.
Russia: documented Russian-origin telecommunications systems connected to Iranian network projects.
Iran: centralized communications infrastructure, state-linked telecommunications providers, the National Information Network, security institutions and domestic technology integrators.
This combination represents a serious digital-authoritarianism and technology-transfer concern.
It does not prove that every Chinese or Russian company whose products appear in Iran knowingly participates in human-rights violations.
Responsibility must be established company by company, transaction by transaction and contract by contract.
Following the Fiber
Iran remains physically connected to the global internet through terrestrial and submarine telecommunications systems.
International connectivity has historically included routes associated with Europe-Persia Express Gateway, Trans-Asia-Europe, FALCON, Gulf Bridge International, Persian Gulf routes, Turkey, the Caucasus, Central Asia and Iran-Oman connectivity.
The strategic importance of these routes lies in concentration.
If international traffic passes through a limited number of controlled backbone networks and gateways, the state does not need censorship equipment in every town.
Control over aggregation points can affect millions of users.
What Open Sources Can and Cannot Establish
Public BGP data, cable maps and internet-measurement systems can identify routes, autonomous systems, international providers, network outages, landing areas and points of traffic concentration.
They generally cannot prove the exact physical rack, room or facility containing a particular DPI appliance.
Exact hardware attribution requires stronger evidence such as engineering plans, procurement records, photographs, serial numbers, maintenance contracts, customs records, configuration files or insider testimony.
That limitation should remain explicit. It strengthens, rather than weakens, the credibility of technical attribution.
PART III: THE SUPPLY CHAIN, CUSTOMS, SERIAL NUMBERS, SANCTIONS EVASION, CRYPTO-FINANCE AND ECONOMIC DAMAGE
The Hardware Does Not Materialize Inside Iran
Advanced network-control infrastructure depends on a global industrial ecosystem.
High-capacity routers, encryption devices, optical-network components, ASICs, processors, servers and security appliances are manufactured internationally.
Sanctions do not automatically eliminate access to this technology.
Restricted equipment may move through secondary markets, re-export, free-trade zones, front companies, false end-user declarations, freight forwarders, repackaging, transshipment, third-country distributors and used-equipment markets.
For investigators, one principle is essential:
The logo on the hardware is the beginning of the investigation, not the conclusion.
A manufacturer may have knowingly supplied an Iranian customer, or it may have sold equipment legally to an intermediary that later diverted it.
The evidentiary chain must distinguish those possibilities.
The Faraz Pardaz Rayaneh Procurement Case
A 2026 U.S. Department of Justice case concerning Tehran-based Faraz Pardaz Rayaneh Co. Ltd., or FPR, illustrates the structure investigators should examine.
According to the criminal complaint, FPR's chief executive Jamshid Ghomi allegedly used intermediaries and front companies to procure U.S.-origin networking equipment for customers in Iran in violation of U.S. sanctions.
The Justice Department alleged that more than 400 purchases of computer-networking equipment were made through eBay and PayPal between 2011 and 2015, with equipment sent to intermediaries in the United Arab Emirates.
It further alleged that in 2023 U.S.-origin networking equipment purchased from suppliers in Minnesota and Nebraska was routed through a UAE front company and then to Iran.
From 2014 to 2018, prosecutors allege that more than 250 metric tons, approximately 275.6 U.S. tons, of networking equipment were moved into Iran through freight forwarders and Dubai intermediaries designed to conceal Iran as the final destination.
These are criminal allegations and do not constitute a finding of guilt unless established through the judicial process.
As a supply-chain model, however, the allegations illustrate precisely how such networks can operate:
Manufacturer, seller, intermediary, UAE front company, freight forwarder, Iranian importer, government-linked end user.
Serial Numbers: The Hardware Fingerprint
Serial numbers can transform a broad allegation into an evidentiary chain.
Investigators who gain lawful access to telecommunications hardware should preserve manufacturer, model, serial number, manufacturing date, hardware revision, MAC address, OUI, firmware version and asset labels.
These identifiers can potentially be compared with dealer records, distributor invoices, warranty registrations, shipping manifests, bills of lading, customs declarations, export licenses, freight-forwarding records and sanctions documentation.
A photograph of a Western manufacturer's logo demonstrates that the equipment exists in Iran.
A serial number may help demonstrate how it arrived there.
That is a substantially stronger form of evidence.
Customs Data and Ports
A serious supply-chain investigation should seek, where lawfully available:
HS code, exporter, manufacturer, seller, consignee, notify party, freight forwarder, bill-of-lading number, container number, weight, declared product description, country of origin, transshipment port, destination jurisdiction, Iranian importer and ultimate end user.
Major free-trade and logistics hubs deserve particular attention because re-export transactions can obscure final destinations.
The UAE, particularly Dubai, appears repeatedly in documented U.S. sanctions-evasion cases involving Iranian procurement, including the FPR allegations.
FANAP and the Localization of Surveillance
Foreign hardware alone does not create an Iranian censorship system.
The critical transformation occurs when imported components are integrated with domestic technology.
An Iranian technology integrator can combine imported networking hardware, domestic software, subscriber databases, government identifiers, local data centers and security-agency access.
That combination turns a general telecommunications platform into an operational surveillance environment.
This can be described as the localization of censorship.
Economic Damage: The Cost of Closing a Digital Economy
Internet shutdowns produce several layers of economic damage.
Direct losses affect transactions that cannot occur; operational losses affect employees who cannot work; payment losses arise when authentication and settlement fail; export losses affect businesses unable to communicate with foreign customers; platform losses affect merchants dependent on social media; reputational losses arise when clients abandon unreliable suppliers.
Reuters reported in April 2026 that estimates of economic damage reached up to approximately $80 million per day, with freelancers, small businesses and digitally dependent companies among the most affected.
These figures were estimates rather than audited national accounts.
Modeled Financial Exposure
If a prolonged 88-day restriction is modeled using a direct-loss range of $30 million to $40 million per day, the resulting exposure would be approximately $2.64 billion to $3.52 billion.
At a broader $70 million to $80 million daily impact range, the modeled total would be approximately $6.16 billion to $7.04 billion.
These are arithmetic scenarios based on published daily-loss estimates, not audited financial statements.
For the February 28 to March 31 period, approximately 32 days, a $30 million to $40 million daily direct-loss range produces modeled exposure of approximately $960 million to $1.28 billion.
For April 1 to May 26, approximately 56 days, the same model produces approximately $1.68 billion to $2.24 billion.
No reliable independently audited dataset currently provides an exact national quarterly figure attributable solely to censorship.
Women and the Online Economy
The economic impact becomes more severe when examined at household level.
Women operating home-based businesses through Instagram, messaging platforms and online marketplaces can lose their customer base immediately when access disappears.
A blackout can mean no customer contact, no payment verification, no product advertising, no logistics coordination, no access to cloud tools and no communication with overseas clients.
The economic cost therefore cannot be understood only through national GDP.
For many households it becomes an immediate livelihood crisis.
Crypto-Forensics: Following the Money
Cryptocurrency has become increasingly relevant to investigations involving Iranian sanctions evasion because blockchain transfers can operate outside conventional banking systems.
But blockchain transactions are not invisible.
Public blockchains preserve transaction histories.
The central forensic challenge is attribution.
Nobitex and Iranian Digital-Asset Infrastructure
In June 2026, the U.S. Treasury designated Nobitex, describing it as Iran's largest digital-asset exchange. Treasury alleged that digital-asset infrastructure had been used by Iranian actors for sanctions evasion and other prohibited financial activity.
The forensic importance of an exchange lies in its position between pseudonymous blockchain addresses and real users.
An exchange may possess KYC records, bank-account information, IP logs, device information, deposit addresses, withdrawal addresses and transaction histories.
Where investigators obtain lawful access to such information, blockchain activity may become attributable to specific people or institutions.
USDT and the TRON Network
The TRON network has become particularly relevant because of widespread use of the USDT stablecoin.
Reuters reported on September 28, 2026 that a U.S. Senate report examined 846 cryptocurrency wallets sanctioned by the United States or Israel and found that 84 percent had interacted with USDT.
Reuters also reported that Tether said it had frozen nearly $550 million in Iran-linked USDT during 2026.
This does not mean that ordinary use of USDT by an Iranian person is illicit.
It means that USDT has become a significant object of investigation in Iran-related sanctions enforcement.
Blockchain Attribution Standards
Responsible crypto-forensics should examine first-hop counterparties, repeated counterparties, exchange deposit clusters, transaction timing, bridge activity, cross-chain movement, stablecoin freezes and connections to sanctioned addresses.
A single transaction is not sufficient to prove control by an intelligence agency or security institution.
Blockchain evidence should be combined with off-chain evidence, financial records, ownership information and sanctions data.
PART IV: HUMANIZING DIGITAL BLACKOUTS, MEDICAL DATA SECURITY, FOREIGN INFLUENCE AND INSTITUTIONAL RESILIENCE
Humanizing Digital Blackouts
An internet blackout is not simply an information-control measure.
Modern healthcare, commerce, education and emergency communication depend on networked systems.
Hospitals and clinics may rely on online appointment platforms, laboratory systems, imaging exchange, drug databases, telemedicine, specialist consultations, prescription management, insurance authorization and cloud-based communications.
When connectivity is heavily disrupted, some of those systems may become unreliable or inaccessible.
During mass repression, the consequences become more severe.
A wounded protester may avoid a hospital for fear of arrest; a family may be unable to locate someone detained or hospitalized; a physician may be unable to reach an outside specialist; journalists may be unable to transmit evidence.
Human Rights Watch specifically warned that Iran's January 2026 blackout concealed reports of large-scale killings and severely obstructed efforts to document violations.
Digital repression therefore has several simultaneous consequences:
Information control, economic disruption, evidence suppression and human-security risk.
A claim that a particular patient's death was directly caused by a blackout, however, requires patient-specific evidence.
Virginia Hospital Center: A Medical Privacy and Counterintelligence Question
A separate issue examined in this report concerns remote medical interpretation.
According to confidential information supplied to this investigation, a patient receiving treatment at Virginia Hospital Center, 1701 N George Mason Dr, Arlington, Virginia 22205, United States, requested language assistance.
According to the source account, hospital personnel positioned a video-interpretation monitor in front of the patient and established a live remote connection with an interpreter who could see and hear the patient while medical information was discussed.
The source further alleges that the interpreter was operating outside the United States, reportedly from Dubai.
Additional confidential-source allegations raise substantially more serious questions regarding possible Iranian or Russian corporate relationships, foreign ownership or foreign access to information within the interpretation network.
Those allegations have not been independently established through the open-source evidence reviewed for this report.
The identities of confidential sources and non-public supporting material are being withheld for source-protection and security reasons.
U.S. Medical Privacy Requirements and Offshore Interpretation
Hospitals in the United States generally operate under strict legal and contractual requirements governing protected health information, including HIPAA. Large healthcare institutions commonly use vetted domestic or international language-service providers and contractual arrangements intended to protect confidentiality, security and patient information.
HIPAA itself does not require an interpreter or interpretation company to be physically located inside the United States.
The U.S. Department of Health and Human Services states that healthcare providers may use external interpreter services and disclose protected health information under specified conditions. Where an interpreter service functions as a business associate, applicable contractual safeguards are generally required.
The important question is therefore not simply whether an interpreter was offshore.
The relevant questions are who controlled the service, where information was processed, which subcontractors had access, whether sessions were recorded, what security standards applied and whether foreign personnel could access identifiable patient information.
The Questions That Require Answers
Who was the interpretation vendor, was the interpreter an employee or subcontractor, in which country was the interpreter physically located, was the session recorded, could administrators replay it, where were connection logs stored, which cloud infrastructure carried the call, what patient information was displayed, were medical records accessible, did offshore subcontractors process protected health information, what Business Associate Agreement governed the service, what screening applied to interpreters, were accounts protected by multifactor authentication, which company controlled the video platform and in which jurisdictions were relevant servers located?
These questions are particularly important in Northern Virginia because the region contains a high concentration of federal, defense, intelligence, law-enforcement and government-contractor personnel.
A patient could theoretically be a member of Congress, a federal employee, an FBI employee or source, an intelligence-community employee, a military officer, a police officer, a diplomat, a political refugee, a dissident, a sanctions investigator, a scientist or a government contractor.
Medical information may reveal identity, location, medication, mental-health information, medical vulnerabilities, pregnancy, family relationships, addiction treatment, surgery schedules, future appointments, physician names, phone numbers and address information.
Audio and video may also contain biometric information.
A face can function as a biometric identifier; a voice can function as a biometric identifier; a hospital room may disclose location; medical history may disclose vulnerability.
Deliberate Mistranslation as a Safety Risk
Medical interpretation is safety-critical.
Even a single incorrect word can affect clinical decisions.
Drug allergy, dosage, symptom location, pregnancy status, suicidal ideation, previous surgery and medication history are examples where mistranslation can create serious consequences.
A deliberate or negligent mistranslation could therefore create substantial clinical risk.
This report does not establish that deliberate mistranslation occurred in the reported Virginia Hospital Center encounter.
The significance lies in the potential vulnerability and the need for auditability.
Institutional Countermeasures and Foreign Influence
A further concern extends beyond telecommunications and healthcare.
It involves the resilience of democratic institutions against foreign intelligence and influence operations.
Iran, Russia and China maintain international intelligence, diplomatic, academic, commercial and influence capabilities.
At the same time, open democratic societies lawfully receive large numbers of students, tourists, businesspeople, researchers, migrants, refugees and temporary workers.
The overwhelming majority of those people have no relationship with a foreign intelligence service.
The vulnerability arises when a government deliberately exploits legitimate civilian channels to place intelligence officers, covert intermediaries, undeclared agents or influence operators close to sensitive institutions.
The objective may not always be the theft of classified information.
Sometimes the goal may be to alter the environment in which decisions are made.
The Erosion of Institutional Decision-Making
A sophisticated influence operation may seek to affect hiring, information flow, expert selection, threat assessment, editorial framing, policy priorities, institutional reputation or access to decision-makers.
A foreign-aligned actor positioned close to a government, media or policy institution may attempt to influence which information reaches decision-makers or how that information is interpreted.
This risk should not be converted into generalized suspicion toward immigrants, students, tourists or ethnic communities.
Counterintelligence must be based on evidence, conduct, undisclosed relationships and state direction, not nationality.
VOA Persian: A Publicly Funded Institution Requiring High Standards
Voice of America is a U.S. government-funded international broadcaster operating within the U.S. Agency for Global Media structure.
Official USAGM materials describe VOA Persian as a Persian-language broadcasting service directed toward audiences in Iran.
Because of that status, VOA Persian occupies a particularly sensitive position.
It is not simply another private Persian-language media outlet.
Its institutional credibility depends on accuracy, balance, editorial independence, transparency, representation of competing perspectives and resistance to factional capture.
Concerns raised by members of Iranian opposition and diaspora communities have at times focused on whether Persian-language broadcasting adequately represents the political, ethnic and ideological diversity of Iranian society.
Those concerns deserve examination through evidence and measurable editorial patterns rather than assumption.
Ali Javanmardi and Questions of Editorial Balance
Ali Javanmardi has appeared in VOA Persian programming discussing Iranian opposition politics, protests, political transition and U.S. policy toward Iran.
GHRNetwork's assessment is that some of these appearances warrant closer editorial analysis concerning political balance, representation of Iran's diverse population and the degree to which particular opposition narratives receive favorable or unfavorable treatment.
The open-source evidence reviewed for this report does not establish that Javanmardi acts on behalf of Iran, Russia or any foreign intelligence organization.
Nor should criticism of editorial direction be converted into an unsupported accusation of espionage.
The legitimate investigative question is institutional.
Does a publicly funded broadcaster intended to reach the broader Iranian population maintain sufficiently transparent editorial safeguards to prevent factional, ethnic, ideological or political preferences from disproportionately shaping coverage?
Iran is not a single political or ethnic constituency.
Its population includes Persians, Kurds, Azerbaijani Turks, Arabs, Baluch, Lurs, Turkmen and numerous smaller communities, together with competing political traditions including monarchists, republicans, secular democrats, liberals, left-wing movements, federalists and minority organizations.
A U.S.-funded Persian-language broadcaster therefore carries a particularly high responsibility to ensure that one political, ideological or ethnic perspective does not dominate coverage without transparent editorial justification.
Relevant accountability questions include who selects recurring guests, which political currents receive the greatest amount of airtime, whether competing Iranian opposition perspectives receive meaningful representation, how ethnic and regional perspectives are balanced, how editorial complaints are reviewed, whether conflicts of interest are disclosed and what mechanisms enforce requirements for accurate, objective and comprehensive journalism.
Information Capture and the Wider Media Environment
The wider concern is not limited to VOA.
Information manipulation can also emerge through networks of media organizations, contributors, editors, political activists, social-media personalities and institutional intermediaries that collectively shape which events become visible and which disappear.
Several types of distortion can emerge.
Suppression by omission: an important event receives little or no coverage.
Narrative minimization: an event is acknowledged but stripped of political or humanitarian significance.
Selective amplification: one faction or political current repeatedly receives greater exposure.
Agenda redirection: coverage repeatedly shifts public attention toward preferred subjects.
Reputational filtering: some individuals or movements are systematically framed more favorably or negatively than comparable actors.
None of these patterns alone proves foreign intelligence direction.
But they create precisely the type of institutional environment that sophisticated influence operations may attempt to exploit.
The Strategic Vulnerability of Open Societies
Democratic openness is simultaneously a strength and a vulnerability.
Universities welcome international students; businesses attract foreign investment; journalists communicate with international sources; researchers collaborate across borders; immigrants participate in civic life; government contractors employ international talent.
Authoritarian states may attempt to exploit legitimate channels through undeclared intelligence officers, front companies, academic relationships, cyber operations, lobbying, media influence, diaspora pressure networks, technology contracts and covert financing.
The appropriate response is not suspicion of entire populations.
The appropriate response is rigorous institutional counterintelligence.
The essential question is whether democratic institutions can reliably distinguish ordinary civilian activity from state-directed influence.
When they cannot, foreign influence may affect not only classified information but the logic of decision-making itself.
The most sophisticated influence operation does not necessarily steal a secret.
Sometimes it attempts to change which facts institutions notice, which voices they amplify and which risks they ignore.
SECTION V: Censorship or Discrimination?
VOA Persian and Other News Media: Editorial Oversight and the Crisis of Trust
By Akbar Amirzadeh Irani
July 30, 2026 | Author
The controversy surrounding Ahmad Batebi’s departure from Voice of America Persian in March 2026 should not be reduced to a personal dispute between Batebi and Ali Javanmardi. It belongs to a broader question about editorial authority, political balance, management structure and public trust across Persian-language media serving Iranian audiences.
The central issue is whether VOA Persian, as a U.S. government-funded broadcaster, has consistently applied the same editorial standards to all major Iranian political currents, particularly during periods of nationwide protest, intense political polarization and heightened public demand for uncensored information.
Batebi said his contract was terminated without a specific explanation. He connected the dismissal to disagreements with Ali Javanmardi, who had been described as overseeing Persian, Kurdish and Afghan television services, concerning coverage of Prince Reza Pahlavi, protest slogans and interviews with Iranians calling for political change. USAGM rejected claims that VOA Persian had instituted censorship against Pahlavi and declined to discuss the personnel decision in detail.
Batebi’s claims should not automatically be accepted as fact. He was directly involved in the employment dispute, and his allegations require corroboration through internal messages, original interviews, editorial directives, testimony from other journalists and newsroom records.
But they cannot simply be dismissed either.
The controversy matters because concerns about the treatment of Prince Reza Pahlavi and certain protest material were reported separately from Batebi’s own account. The broader question is therefore not whether one former employee should be believed in every detail, but whether a consistent editorial pattern existed.
The Difference Between Editorial Judgment and Political Filtering
Every newsroom edits material.
Footage is shortened, interviews are condensed, unverified claims are removed and repetitive material is excluded.
None of that is censorship by itself.
The problem begins if politically significant information is excluded primarily because of the identity of the political figure involved.
If protesters demonstrably chant the name of Prince Reza Pahlavi, that is part of what happened at the demonstration.
A broadcaster does not have to endorse him.
It does not have to amplify him.
It does not even have to agree that his supporters represent the majority of Iranians.
But it should have a defensible journalistic explanation if such material is consistently removed while politically comparable material involving other factions is retained.
That distinction, between refusing to campaign for someone and refusing to report what is actually happening, is at the heart of the VOA Persian controversy.
Batebi Is Not the Entire Story
The strength of the case should not depend on Ahmad Batebi’s personality, history or political reputation.
He may be correct about some events and mistaken about others.
If he possesses raw interviews, communications or editorial instructions supporting his account, those records matter.
If those records contradict him, that matters as well.
The appropriate journalistic standard is evidence.
That protects both sides.
It prevents Batebi from converting an employment dispute into an unquestioned political narrative, and it prevents management from dismissing legitimate concerns simply because the person making them is controversial.
Ali Javanmardi’s Cross-Service Role
One of the most significant institutional questions concerns the concentration of authority.
Public VOA material identified Ali Javanmardi as a senior adviser overseeing Persian, Kurdish and Afghan television services.
That arrangement is not automatically improper, but it deserves examination because those services address substantially different political environments, national histories and audience expectations.
Iranian Persian-language journalism must navigate questions involving the Islamic Republic, monarchists, republicans, ethnic movements, secular groups, religious minorities, territorial integrity and diaspora politics.
Kurdish journalism operates within a different political landscape, including disputes over cultural rights, federalism, autonomy, national identity and relations across Iran, Iraq, Syria and Turkey.
Afghanistan, although linguistically and historically connected to Iran in important ways, is a separate country with its own institutions, conflicts, ethnic dynamics and political history.
Managing multiple services is not evidence of bias.
But the greater the concentration of editorial authority, the stronger the need for transparent safeguards, specialized editors and clear lines of responsibility.
The question is not whether someone of Kurdish background can manage Persian broadcasting, or whether an Iranian journalist can work on Afghan affairs.
That would be the wrong question.
The relevant issue is professional specialization and editorial independence.
The Comparison With Other Persian-Language Broadcasters
The VOA controversy is also easier to understand when compared with how other major Persian-language broadcasters approached the same period.
Iran International maintained continuous 24-hour Persian-language news coverage and describes its editorial mission as presenting diverse political, social and economic views. During the January 2026 protests, it repeatedly published material from different Iranian cities, including videos of demonstrations, eyewitness reports, anti-government slogans and footage containing explicit support for Prince Reza Pahlavi. Iran International
Its January coverage included reports of demonstrations across Tehran and other cities, including footage in which protesters could be heard chanting both anti-government slogans and slogans supportive of the monarchy. Iran International
During the severe internet restrictions that accompanied the crackdown, Iran International continued publishing eyewitness accounts and videos received from inside the country, while explicitly noting when independent verification was constrained by the communications blackout. Iran International
Radio Farda likewise maintained continuing coverage of Iran and operates a dedicated live-coverage format that aggregates official statements, developments inside Iran and reporting from international and Iranian sources. Its Iran section in 2026 continued extensive reporting on the aftermath of the protests, casualties, government actions and international responses. Radio Farda
These examples do not establish that Iran International or Radio Farda are free from editorial bias.
No serious news organization should be granted such an assumption.
Their ownership structures, editorial priorities and individual reporting decisions can and should also be scrutinized.
But their protest coverage provides a useful comparison.
During major unrest, both organizations demonstrated that it was possible to report anti-government protests, competing slogans, eyewitness testimony and rapidly changing political developments without making the coverage entirely dependent on a single opposition current.
That is an important point.
Reporting that demonstrators support a particular political figure is not the same thing as endorsing that figure.
Reporting government supporters is not the same thing as endorsing the government.
Reporting republicans, monarchists, ethnic activists or protesters who reject all existing opposition organizations does not require a broadcaster to choose among them.
The journalistic task is to show the audience what is happening.
A More Encouraging Model
The strongest element in the broader Persian-language media environment may therefore be diversity itself.
Iran International’s declared editorial policy says it aims to carry different political and social viewpoints, while its continuous news operation gives it the capacity to update major developments throughout the day. Iran International
Radio Farda’s continuing Iran coverage similarly provides an alternative stream of reporting, particularly during periods when communications inside Iran are restricted. Radio Farda
During the 2026 protest period, the existence of multiple Persian-language outlets monitoring demonstrations simultaneously gave audiences the ability to compare reports rather than depend on one institution.
That is potentially more important than the political reputation of any individual broadcaster.
A healthy information environment is not created because one network is declared completely neutral.
It is created when several professional newsrooms publish verifiable information, distinguish reporting from commentary, disclose uncertainty and allow audiences to compare competing accounts.
Why VOA Faces a Different Standard
VOA, however, occupies a different institutional position.
Iran International is a private media organization.
Radio Farda is also part of U.S. international broadcasting, but operates as a separate service under Radio Free Europe/Radio Liberty.
VOA is governed by its own statutory Charter.
That Charter requires its reporting to be accurate, objective and comprehensive, and requires VOA to represent America, not a single segment of American society.
This makes allegations of selective political filtering particularly serious.
The question is not merely whether VOA Persian has a political tone.
The question is whether its editorial practices comply with the standard imposed upon it by law and by its publicly funded mission.
Partisan Perceptions and the Need for Evidence
Some Iranian and Iranian-American viewers have long perceived VOA Persian as being closer to particular currents within U.S. politics, including at times Democratic foreign-policy thinking.
Other audiences, particularly during different administrations, have accused U.S. international broadcasters of excessive alignment with Republican administrations.
Those perceptions matter because they affect credibility.
But they are not proof.
There is currently no sufficient public evidence to state as fact that Ali Javanmardi was installed at VOA to advance the agenda of the Democratic Party, another political party or an undisclosed political organization.
Nor should such a conclusion be implied without documentary evidence.
A stronger institutional criticism is available without speculating about secret political loyalty.
No administration, Democratic or Republican, should be able to turn VOA into its partisan broadcaster.
The same principle should apply to internal Iranian political factions.
One Standard for Every Political Current
VOA Persian should not promote Prince Reza Pahlavi.
It should not suppress him.
It should not favor Iranian republicans.
It should not marginalize them.
It should not privilege Kurdish political organizations.
It should not exclude Kurdish political concerns.
It should not treat Afghan political affairs as merely an extension of Iranian politics.
Its responsibility is to provide enough verified information for viewers to understand the competing forces.
That requires something more demanding than mechanical balance.
It requires consistent standards.
If video evidence is considered newsworthy when protesters chant against the Islamic Republic, the same editorial test should apply when protesters chant the name of an opposition figure.
If one political faction’s representatives are challenged aggressively, comparable scrutiny should apply to competing factions.
If political advocacy is excluded, it should be excluded under the same rule regardless of who benefits.
The Institutional Questions That Remain
The controversy can ultimately be reduced to several questions that VOA and USAGM should be able to answer with documentation.
Who possessed final editorial authority inside VOA Persian?
What written standards governed references to Prince Reza Pahlavi?
Were reporters instructed to remove his name from interviews or protest material?
If so, why?
Were equivalent restrictions applied to other opposition figures?
Did the person overseeing Persian, Kurdish and Afghan broadcasting have direct authority to alter newsroom decisions?
What safeguards existed to prevent one political or regional perspective from dominating three different services?
Were journalists able to challenge editorial decisions without professional retaliation?
These questions are more important than arguments about personalities.
Conclusion: The Crisis Is About Trust
The Ahmad Batebi case may eventually prove to contain exaggerations, misunderstandings, legitimate grievances, or some combination of all three.
That can only be determined through evidence.
Ali Javanmardi should be judged by the same standard.
But the controversy has exposed a larger problem.
A significant portion of the Persian-speaking audience no longer seems willing to accept assurances of neutrality without seeing how editorial decisions are actually made.
For a taxpayer-funded broadcaster, that is a serious warning.
VOA cannot function as the broadcaster of one American party during one administration and the broadcaster of another party after the next election.
It cannot operate as the preferred platform of one Iranian opposition faction while systematically restricting another.
Its credibility depends on demonstrating that the same rules apply across political boundaries.
The comparison with Iran International, Radio Farda and other Persian-language media also shows why the issue matters.
During periods of extraordinary political upheaval, multiple Persian-language outlets were able to maintain continuous reporting, receive eyewitness material, document competing protest slogans and update audiences while acknowledging uncertainty when verification was difficult. Iran International’s January 2026 reports provide concrete examples of that approach, while Radio Farda maintained continuing Iran-focused and live coverage throughout the period. Iran International
Those outlets should themselves remain open to criticism and scrutiny.
But the broader lesson is constructive.
Persian-language journalism does not have to choose between becoming a political campaign and becoming a gatekeeper that suppresses politically inconvenient information.
It can document what demonstrators say, report competing political currents, distinguish verified information from allegation and allow the audience to decide.
That is particularly important for VOA.
Because VOA is not owned by Ali Javanmardi, Ahmad Batebi, Prince Reza Pahlavi, Democrats, Republicans or any Iranian political organization.
It is a publicly funded American institution.
Its strongest defense against accusations of political bias is therefore not a press statement.
It is transparency.
Transparent editorial rules, specialized management, documentary accountability, consistent treatment of competing political currents and visible independence from partisan pressure are the only durable answers to a crisis of trust.
SECTION VI: Screening, Entry Control and the National-Security GAP
The vulnerability of an open society begins before a suspected foreign intelligence operative, terrorist facilitator or state-directed intermediary reaches American soil.
Foreign governments and terrorist organizations do not necessarily attempt to move personnel across borders under an openly hostile identity. Intelligence officers, facilitators, undeclared agents and operatives may seek to exploit ordinary civilian channels, including business travel, university enrollment, professional employment, temporary work, tourism, exchange programs, family-based immigration and other lawful travel mechanisms.
That does not mean that students, businesspeople, refugees, immigrants or travelers as a class should be treated as security threats. The overwhelming majority have no connection to terrorism or foreign intelligence activity.
The security problem is narrower and more difficult: identifying the comparatively small number of individuals who may deliberately conceal state direction, terrorist affiliation, operational intent or material relationships with hostile organizations.
The First Gate: Visa Adjudication
For most foreign nationals seeking to travel to the United States, the first formal screening decision occurs within the visa process administered by the U.S. Department of State.
Consular officers at U.S. embassies and consulates determine whether an applicant is eligible to receive a visa under U.S. immigration law.
The Department of State itself describes visa adjudication as a national-security decision and states that it relies on available information to identify applicants who may present national-security or public-safety concerns.
A consular officer therefore does considerably more than conduct a routine interview.
The adjudication may involve identity checks, database screening, security information, immigration history, travel history, criminal or terrorism-related information, documentary review and, where required, additional interagency vetting.
Under U.S. immigration law, a person may be inadmissible when a consular officer, immigration officer or other authorized official knows or has reasonable grounds to believe that the person seeks to engage in espionage, sabotage, terrorism or other prohibited activity.
For nationals of countries designated by the United States as State Sponsors of Terrorism, including Iran, federal law also imposes special processing requirements. The Department of State states that applicable applicants generally require an interview and that a visa should not be issued unless the government determines, in consultation with other appropriate agencies, that the applicant does not pose a threat to U.S. safety or national security.
The legal framework therefore already recognizes a fundamental point:
A visa decision is not merely an administrative travel decision. It can be a national-security screening decision.
A Visa Is Not Final Permission to Enter
The distinction between visa issuance and admission to the United States is important.
A visa generally permits a traveler to present himself or herself at a U.S. port of entry and request admission.
The final admission decision is normally made by officers of U.S. Customs and Border Protection, part of the Department of Homeland Security.
The national-security screening architecture is therefore distributed across several institutions rather than concentrated exclusively in the Department of State.
The FBI’s Threat Screening Center supports this broader system. According to the FBI, terrorism watchlist information can be used for Department of State visa and passport screening, CBP international-entry screening, TSA passenger screening, USCIS immigration screening and FBI investigations.
Responsibility should therefore not be reduced to one officer, one embassy or one agency.
It is an interagency security chain.
The Limits of Database-Dependent Screening
The existence of sophisticated databases does not eliminate human judgment.
A screening system can identify only information that has been collected, correctly attributed, shared, indexed and made available to the adjudicating agencies.
A person who uses a false history, an incomplete identity, a legitimate business cover, a new intermediary, a clean passport, an undisclosed organizational relationship or a previously unknown operational network may not generate an obvious database alert.
This is where professional judgment becomes critical.
A visa interview should not be reduced to a mechanical comparison between an application form and a computer screen.
Where lawful authority and risk indicators justify further examination, officers may need to consider inconsistencies in biography, unexplained travel, employment relationships, organizational affiliations, financial patterns, prior addresses, multiple identities, social-media information, corporate connections, sponsorship arrangements and other contextual information.
The objective should not be indiscriminate suspicion.
It should be risk-based scrutiny.
Nationality alone is not evidence of terrorism.
Ethnicity is not evidence of espionage.
Political disagreement is not evidence of foreign-agent status.
But credible indicators of undisclosed state direction, terrorist affiliation, operational preparation or deceptive conduct warrant closer investigation.
Iran and the Documented Transnational Threat
This concern is not hypothetical.
The FBI states that the Iranian government presents threats involving foreign intelligence, terrorism, cyber operations, sanctions evasion and transnational repression, and that Iranian authorities and affiliated actors have attempted kidnappings, assassination plots and other operations directed at people inside the United States.
A particularly significant example emerged in the federal prosecution of Asif Merchant.
In March 2026, a federal jury convicted Merchant of murder-for-hire and attempting to commit an act of terrorism transcending national boundaries. According to the U.S. Department of Justice, Merchant admitted that the Islamic Revolutionary Guard Corps sent him to the United States to arrange political assassinations. He entered the United States in 2024 and was arrested after meeting individuals he believed could participate in the plot; those individuals included undercover law-enforcement personnel.
The case demonstrates both sides of the problem.
First, a trained operative associated with the Iranian state succeeded in entering the United States.
Second, U.S. law enforcement subsequently detected and disrupted the operation before the planned attack occurred.
That distinction is important.
It would be inaccurate to conclude that the FBI becomes powerless once a dangerous individual enters the country.
The opposite is demonstrated by the Merchant case: the FBI and other law-enforcement agencies can investigate, surveil under lawful authority, use confidential sources, conduct undercover operations, arrest suspects and refer cases for federal prosecution.
The FBI’s Role After Entry
The FBI is the principal federal agency responsible for investigating and preventing acts of domestic and international terrorism within the United States.
Its Joint Terrorism Task Forces integrate federal, state and local capabilities, and the FBI also carries principal domestic counterintelligence responsibilities concerning foreign intelligence activity occurring inside the United States.
The FBI states that it actively investigates Iranian intelligence operations, terrorism, attempted kidnappings, assassination plots and foreign influence activity directed at U.S. persons.
Entry into the United States therefore does not create immunity from investigation.
Nor does visa issuance transfer all future responsibility away from other agencies.
If credible information arises after admission, the FBI, Department of Homeland Security, Department of Justice and other authorities may investigate and take action according to their respective statutory powers.
The CIA’s Different Role
The CIA occupies a different position.
It is primarily a foreign-intelligence organization, not a domestic police agency.
The CIA itself states that it has no general law-enforcement authority and that the FBI is principally responsible for domestic intelligence and criminal investigations.
The CIA nevertheless contributes to counterterrorism by collecting and analyzing foreign intelligence about terrorist organizations, foreign governments and overseas networks and by sharing relevant intelligence with U.S. partners.
Accordingly, asking why “the CIA did not arrest” an individual inside the United States misunderstands the division of authority.
The more relevant question is whether foreign intelligence was collected, correctly analyzed and transmitted to the agencies responsible for visa screening, border security or domestic investigation.
The Core Accountability Question
When an individual later proven to be a terrorist operative, intelligence officer or state-directed agent successfully enters the United States, accountability should not automatically be assigned to whichever agency ultimately discovers the threat.
The more useful inquiry is chronological:
What information existed before the visa was issued?
Which agency possessed it?
Was it shared?
Was it searchable?
Did the applicant make false statements?
Were additional security checks requested?
Was relevant intelligence available but not acted upon?
Did the person become operational only after entering the United States?
Was there information that no reasonable officer could have discovered during the visa process?
Those distinctions matter.
A consular officer cannot reasonably be held responsible for intelligence that did not exist or was inaccessible.
But where credible derogatory information was available and should have been discoverable through required procedures, the failure to identify it becomes an institutional screening question.
Human Judgment Must Complement Automated Vetting
Modern screening systems increasingly depend on interconnected databases, biometric systems, watchlists, travel histories and automated matching.
Those tools are indispensable.
They are not sufficient by themselves.
A computer can identify a recorded match.
It cannot always explain an unexplained career transition, a suspicious corporate relationship, a concealed handler, an implausible travel pattern or a newly created operational identity.
Effective screening therefore requires both technology and professional judgment.
Consular officers, border officers, immigration adjudicators, intelligence analysts and investigators must be able to escalate cases when available facts do not make sense.
That does not mean transforming ordinary immigration processing into indiscriminate counterintelligence interrogation.
It means ensuring that credible security indicators receive serious review rather than being dismissed because an applicant has produced technically valid documents or passed an initial database query.
The Scale Problem
The United States processes enormous volumes of international travel, visas and immigration applications.
No security service can physically monitor every foreign visitor after arrival.
That makes pre-entry screening particularly important.
But it also explains why the security system must remain layered.
State Department screening, intelligence collection, terrorism watchlisting, CBP inspection, USCIS vetting, FBI counterintelligence, Joint Terrorism Task Forces, federal prosecution and cooperation with state and local law enforcement each address a different point in the threat cycle.
No single institution can substitute for the others.
Terrorist Organizations and State-Directed Networks
The same analytical framework applies to organizations designated or treated by U.S. authorities as terrorist threats, including the Islamic Revolutionary Guard Corps and organizations linked to or supported by Iran.
U.S. authorities have documented continuing attempts by Iranian actors and affiliated networks to target individuals and institutions in the United States.
In 2026, the Department of Justice also charged a dual Iranian-Iraqi national alleged to have operated for Kata’ib Hizballah and the IRGC and to have participated in international terrorist planning, including alleged efforts to direct attacks against targets in the United States. Those allegations remain pending unless established through conviction or final judicial findings.
Such cases demonstrate why screening should focus not merely on nationality but on networks, affiliations, conduct, travel, communications, financing and state direction.
Prevention Cannot End at the Embassy Door
The central policy lesson is therefore not that responsibility belongs exclusively to the State Department, the FBI, the CIA or DHS.
Responsibility is sequential and shared.
The State Department controls visa adjudication.
DHS and CBP control admission at the border.
USCIS performs immigration and national-security screening in matters within its jurisdiction.
The FBI investigates domestic terrorism and foreign-intelligence threats.
The CIA collects foreign intelligence and provides information relevant to threats originating abroad.
The Department of Justice prosecutes federal criminal and national-security cases.
A failure at one stage can increase the burden placed on every stage that follows.
The strongest security architecture is therefore one in which intelligence collected overseas can reach visa adjudicators, terrorism screening can inform border inspection, suspicious entry information can reach investigators, and domestic investigations can feed new intelligence back into future screening.
The issue is not simply who issued a visa.
The deeper question is whether the entire system connected the available information before a threat became operational.
Research, Investigation, Compilation | Writing by Akbar Amirzadeh Irani, May 8, 2026
CONCLUSION
Iran's repression system during 2025 and 2026 cannot be understood by examining executions, street violence, censorship, procurement, cryptocurrency or surveillance independently.
The evidence points toward an increasingly integrated architecture.
The judiciary provides legal coercion, the prison system provides confinement, the IRGC, Basij, police and intelligence services provide physical enforcement, the National Information Network provides domestic digital isolation, DPI and routing control provide network-level enforcement, foreign technology can supply critical components, Iranian firms can integrate those components, third-country intermediaries can obscure procurement and cryptocurrency can provide alternative financial rails.
The victims encounter the final product.
A protester sees a rifle; a journalist sees a blocked connection; a woman sees a surveillance camera; a business owner sees an inaccessible customer base; a prisoner sees a Revolutionary Court; an investigator sees a shell company; a customs analyst sees a container; a blockchain analyst sees a wallet; a telecommunications engineer sees a route.
The systems may appear separate.
They are increasingly connected.
The next stage of serious investigation must therefore join the evidence:
Hardware serial numbers, customs records, corporate ownership, shipping manifests, network telemetry, telecommunications procurement, sanctions records, court documents, blockchain transaction graphs and confidential witness testimony.
The principle is straightforward:
Follow the equipment, follow the network, follow the money, follow the decision chain and preserve the evidence.
SOURCES AND REFERENCE MATERIAL
Human Rights, Executions and Protest Repression
Human Rights Watch, World Report 2026: Iran, executions, discrimination and human-rights conditions
Human Rights Watch, Iranian Authorities Brutally Repressing Protests, December 2025 to January 2026 uprising
Human Rights Watch, Growing Evidence of Countrywide Massacres, January 2026
Human Rights Watch, Iran's Internet Blackout Concealing Atrocities
Human Rights Watch, Iran Internet Shutdown Violates Rights, Escalates Risks to Civilians
Iran Human Rights, Execution Statistics and Documentation
Internet, DPI and Network Control
Filterwatch, Technical Breakdown of the January 2026 Shutdown
Filterwatch, January 2026: From Regional Disruptions to Total Blackout and Whitelisted Access
Reuters, Iran Eases Internet Curbs for Businesses as Blackout Enters Third Month
Citizen Lab, You Move, They Follow: Uncovering Iran's Mobile Legal Intercept System
Procurement, Sanctions and Technology Supply Chains
U.S. Department of Justice, Faraz Pardaz Rayaneh Procurement Case
U.S. Treasury, FANAP and Iranian Surveillance Network
Cryptocurrency and Financial Forensics
U.S. Treasury, Nobitex and Iranian Digital-Asset Infrastructure
Reuters, Tether USDT and Iran-Linked Financial Networks
Medical Privacy and Interpreter Services
Virginia Hospital Center (VHC Health)
1701 N George Mason Dr, Arlington, Virginia 22205, United States
U.S. Department of Health and Human Services, HIPAA and Interpreter Services
U.S. Department of Health and Human Services, HIPAA Business Associate Guidance
VOA Persian and Public Broadcasting
Voice of America Persian News Network, background reference
U.S. Agency for Global Media, VOA Persian Language Division
Voice of America Persian, Ali Javanmardi programming
Investigative Note
This report is based on open-source research, official government records, international human-rights reporting, technical network measurements, sanctions documentation, investigative journalism and confidential-source information.
Findings attributed to organizations such as Human Rights Watch, Reuters, U.S. government agencies and other identified sources are presented according to the underlying published records. Where this report refers specifically to criminal complaints, pending legal proceedings or uncorroborated confidential-source information, those claims are clearly identified as allegations or unverified information.
The identities of confidential sources and non-public supporting materials are withheld for security, privacy and source-protection reasons.
Research, investigation, compilation, and writing by Akbar Amirzadeh Irani.
