Internal carrier documents detail SIAM, an Iranian government web program to remotely alter, disrupt, and monitor how the country's people use their phones
The Intercept : Tweets: @theintercept , @jasminramsey , @kenklippenstein , and @mazmhussain Tweets: @theintercept : “These documents prove something that we have long suspected, which is that even devices that use encryption for messaging are still vulnerable because of the nature of internet infrastructure in Iran,” said @maasalan of @article19org. https://theintercept.com/... Jasmin Ramsey / @jasminramsey : Important read by @samfbiddle & @MazMHussain who got their hands on documents detailing how the government in Iran tracks down protesters' locations + gains access to their private comms. It's worse than you thought. #Mahsa_Amini #IranRevolution https://theintercept.com/... Ken Klippenstein / @kenklippenstein : Hacked documents obtained by @samfbiddle & @MazMHussain reveal the secret methods by which the Iranian gov't can track and control protesters' mobile phones. https://theintercept.com/... Murtaza Hussain / @mazmhussain : The Intercept obtained leaked documents on a secret Iranian government program for surveilling and controlling cellphone and internet users. The program is called SIAM and we are publishing documents on it today. https://theintercept.com/... via me and @samfbiddle:
Context & Ripple Effects
Iran's playbook has escalated in granularity over five years: authorities first temporarily cut off mobile internet outright when the 2017 protests spread, then pursued a broader program of tightening internet controls as US sanctions and cyberattacks escalated. The SIAM documents show the next stage — instead of switching networks off, the state can reach into individual handsets through the carriers.
That matters because, as ARTICLE 19's point in the coverage makes clear, even encrypted messaging apps sit on top of Iranian internet infrastructure the government can manipulate. The leak also prefigures what researchers later outlined: surveillance capabilities integrated across Iran's communications and internet networks and used to track down protesters.
First-order effects
- Protesters and ordinary subscribers are directly exposed: carrier-run SIAM gives the government remote ability to alter, disrupt, and monitor phone use, including locating individuals and reaching communications despite end-to-end encryption at the app layer.
- Iranian carriers are cast as instruments of state surveillance, with internal documents confirming their networks are the delivery mechanism for government commands against their own customers.
Second-order effects
- Granular per-user control changes the economics of crackdowns: where the record national blackout described by NetBlocks cost an estimated $80M per day, SIAM-style targeting lets the state suppress dissent without paying the full price of disconnecting the country.
- Trust in domestic connectivity erodes — users who learn that encrypted apps remain vulnerable on Iranian infrastructure face pressure toward foreign eSIMs, VPNs, and out-of-country relays, shifting usage patterns the carriers themselves cannot fully serve.
Third-order effects
- If the pattern holds, Iran's censorship architecture completes a shift from coarse network shutdowns to integrated, identity-level surveillance spanning telecom and internet layers — the trajectory the later researcher reporting describes as capabilities woven across the country's networks.
- The documents give digital-rights groups like ARTICLE 19 concrete evidence for the argument that encryption alone cannot protect users where the underlying infrastructure is hostile, sharpening the case for infrastructure-level scrutiny in authoritarian markets.
The trend: State digital control is moving from blunt nationwide shutdowns toward carrier-embedded, per-user surveillance systems that operate beneath app-layer encryption.