With Eye on Telegram, Internet Body Says All Social Media Apps Must Store Data Inside Iran

The Supreme Cyberspace Council in session.

To improve Iran’s ability to monitor and censor online content and user activity, the country’s Supreme Cyberspace Council (SCC) has ruled that all foreign social media networks must store domestic traffic data inside Iran.

The SCC, which sets internet policy in Iran, has no path to force foreign social media apps to comply with the legally binding ruling. Rather, the step was taken to pressure foreign social media companies that wish to maintain a presence in Iran to aid the state’s surveillance efforts or face being blocked.

The ruling, issued on August 7, 2017, was announced a few weeks after the Telegram messaging application surrendered to state pressure from Russia and agreed to register there, where the app was founded, and store its user data in the country for six months.

According to Article 2 of the SCC’s ruling, foreign messaging networks must store their Iranian data inside Iran and have a representative based inside the country in order to operate there.

“The operational conditions of the messaging services will be prepared and compiled under Telecommunications Ministry guidelines by a working group comprised of representatives from the ministries of telecommunications, culture and Islamic guidance, and intelligence, as well as the president’s office, the prosecutor general’s office, the Islamic Propagation Organization, the cyber police force, and the Islamic Revolution’s Guard Corps,” according to the SCC ruling.

Telegram is the most widely used private messaging and social media app in Iran, where it used by 40 million people, according to its founder and CEO Pavel Durov.

Demands by Iranian officials that Telegram aid state surveillance efforts, coupled with the company’s recent decision to use Iranian technological infrastructure, have resulted in calls for the company to guarantee the highest level of user privacy and security measures. 

In July 2017, the Center for Human Rights in Iran (CHRI) reported that the company had installed closed content delivery networks (CDNs) —caching servers that allow faster delivery of multimedia data—in Iran.

Telegram has consistently pledged it will not compromise user accounts in any country context. Its FAQs page states it has not placed “Telegram servers” in Iran, but only CDNs for “caching media from public channels with over 100,000 members.”

However, Telegram’s agreement to register in Russia, where there are only six million users, has raised fears that the company will also eventually capitulate to pressure from Iranian state authorities to store its servers domestically.

“Given the Iranian government’s consistent pattern of pressuring companies to enter into arrangements that could potentially affect user access or security, we urge Telegram to be fully transparent about all requests from the Iranian government,” said CHRI’s Executive Director Hadi Ghaemi.