The death of 22-year old Masha Amini at the hands of the Iranian Morality Police on September 16th, after a three-day detainment for improperly wearing a hijab has triggered countrywide protests. These protests triggered a brutal and lethal response by Iranian security forces, including the Iranian Republican Guards Corps (IRGC) over the last month.
Recent foreign policy efforts by academics and researchers have focused on great power competitors like China and Russia, however, Iran holds significant open-source intelligence (OSINT) through social media streams.
This Overwatch brief will focus on the OSINT indicators that will address whether the Iranian regime views the demonstration as a security threat or a political issue.
The Green Revolution
In 2009, the Green Revolution played out on social media and was missed by the U.S. Intelligence community due to discounting OSINT as an intelligence discipline. The Iranian instance is notable for demonstrations since the Green Revolution spilled into streets and leveraged the internet and social media to coordinate messaging and actions. In response, the Iranian regime relied on traditional state media sources, blocking internet access and violent repression to counteract protests. The recent demonstrations follow a similar cycle: countrywide protests and demonstrations, with the regime utilizing the state media apparatus, internet outages, and violent responses, particularly against minority ethnic and tribal groups.
Combating a Digital Evolution through Traditional ‘Blackout’ Tactics
Since the Green Revolution, the digital landscape has evolved substantially but the Iranian government methodology has not. With Facebook and Twitter rising in popularity among Iranians, the Iranian government saw this as a disruptor and imposed a week-long digital blackout initiating a brutal crackdown in 2019.
Today the Iranian government decided to adopt rolling blackouts, targeting specific provinces that are composed of larger minority/ethnic groups. On September 21st, Iran curtailed access to Meta platforms, Instagram and What’s App. The routine blackouts are not inclusive to Meta-owned apps, TikTok and YouTube have routinely been blocked as well. Most of the blackouts are centered on Kurdish areas in Iran; Amini was Kurdish. Real-time network data shows a nation-scale loss of connectivity on MCI (First Mobile), Iran’s leading mobile operator, and Rightel.
Because there is no private news site, the internet is the primary source of information outside Iranian government-controlled media. Most information comes from second-long video snippets activists manage to send through intermittent internet access as the Iranian government’s censorship efforts.
Today’s Protest is not a Pattern of Past Protests
Up to now, the Iranian government does not appear to feel more vulnerable than they did in years of previous protests fueled by economic grievances: 2019, 2021, and earlier this year. That said, the real question is whether or not the regime leadership understands there are differences. According to Sanan Nivkol, a senior research fellow for the Middle East and North Africa Program at Chatham House in London, the people are asking for significant political change, generating solidarity among different social groups. Over the past week, October 7-14, 2022, reports of strikes across other sectors of the economy have surfaced raising stakes.
As noted by Esfandyar Batmanghelidj, founder, and CEO of the Bourse & Bazaar Foundation in London, “if they (the regime) see this as a security threat and not as an issue of political expedience, then they are more likely to respond to using tools of their security apparatus” and “the government has far more capacity for repression than it does for reform at this stage.”
Batmanghelidj poses a fundamental question concerning how the regime perceived these demonstrations as a security threat or a political problem. OSINT plays an important role in assessing the Iranian’s regime’s perception of events. One significant event occurred on October 8, 2022, when a group identified as “Adalat Ali” or “Ali’s Justice” hacked the Iranian News Agency (IRNA) and played a 30-second video.
The video features a picture of Iran’s supreme leader, Sayyid Ali Hosseini Khamenei, with a target on his head. The video clip also includes photos of the women Iranian authorities killed: Nika Shakarami, aged 16, Hadis Najafi, age 20, Mahsa Amini, age 22, and Sarina Esmailzadeh, age 16. One of the captions read, “join us and rise up,” while another said, “our youths’ blood is dripping off your paws.”
The young women have become symbolic of the Iranian population, which is largely young and unaware of Iran outside the control of the current regime. The women and responses challenge the regime’s political views as changes to women’s laws would not be welcomed by the current regime. To control the narrative, the Iranian government has used their official state-run print, radio and television to attribute the womens’ death to natural causes, freak accidents, and/or suicide. Beyond these instances, the regime has relied on silence or attributing the violence to foreign influence and/or unknown separatists. It has purposely refrained from referencing women or the role of women in public statements.
Anti-regime Iranian hackers have not backed down, instead they have started releasing emails and documents associated with the “Iran Atomic Energy Production and Development Company” seemingly making good on a threat they made in response to the regime’s crackdown on protesters. If these leaks are valid and continue, this could prove a critical vulnerability for the Iranian regime and may solicit an even greater swell of a response.
Our Assessment
The protests and landscape is one to monitor with a close eye across the social streams, as many turn to social media to show their support and fight against the challenge of the patriarchal regime, and potential indicators to determine the regime’s perceived level of vulnerability.
One indicator is a direct mention of women in their state-run media. This would be a shift in the regime to begin and acknowledge the role of women and young females in protests. It also shows the regime is concerned that protest demands have grown beyond the control of traditional repression tactics. Even further, the state-run media has not acknowledged the burning of hijabs and haircutting in their public statements. If they begin to, this communicates dissent within the regime’s political and security apparatus, potentially manifesting other officials to leverage social media to call for political change or reform on women’s issues or moderating other issues. All potential signs that they seek to resolve this politically to avert further instability and strikes across the Iranian economy.
Secondly, the control of the internet. Currently, the regime appears convinced rolling internet outages in regions such as Kurdistan and other minority-dominated areas are sufficient. The short video clips on social streams depict protesters clashing with security forces are not currently impacting the regime’s internal calculations. The videos do validate the narrative that these are security threats from separatists and/or foreign-sponsored actors. An outright internet shutdown and other national communications would indicate that the regime perceives substantial threats from protestors’ social content and will resort to brutal tactics to suppress demonstrations.
Lastly, an interesting aspect would be the emergence of a leader or leaders within the movement. The regime’s allowance of the formation of such a structure, which would allow some negotiations and/or acceptance of a political solution serves as a potential indicator of the regime’s intentions and/or willingness. If the regime elects to stifle or eradicate such nascent structures could lend credence to their perception that the movement is a security threat. The extent of women’s rights or women leaders in this leadership will also provide indicators of the regime’s thinking. The scope of women’s involvement or presence in an emerging organization would paint a picture of the regime’s view of the situation as a security threat or a political adjustment.