Jul 01 2022

About this Investigation:
The Noyan Abr Arvan company has recently signed a contract with the Ministry of Information and Communications Technology of Iran. In this report, Zamaneh endeavors to look at Abr Arvan, its background, and its aforementioned contract and interaction with the Iranian government regarding building the internet cloud infrastructure.

”Unfortunately, in our country’s cyberspace, people disregard my insistence and guidance and it [the internet] is too morally loose in some regards. People in charge should be mindful of this. All countries in the world manage and control their cyberspace, [but] we are proud of our lack of control on our cyberspace. We should not be proud of this, there is no dignity in this at all. The cyberspace should be controlled and guided.” – Ali Khamenei, the Supreme Leader of the Islamic Republic of Iran, at his Nowruz oration on March 20th, 2021

Since the arrival of the internet in Iran, monitoring and controlling the internet have been one of the main concerns of the government, and they have implemented various measures in this regard. One of the most important of these designs is the National Information Network (Shoma). Many information technology companies are increasingly working on governmental infrastructure and internet localization projects in the last few years. Abr Arvan is one of these companies, the activities of which have raised concerns about the role of private companies in helping the Iranian government dominate the internet.

What Do We Know about Abr Arvan?

Noyan Abr Arvan Co. was founded in 2015 as a startup in the integrated cloud computing domain. This company provides products like public content delivery network (CDN), cloud security, video platform, live broadcasting, Infrastructure as a Service (IaaS) and Platform as a Service (PaaS).

Abr Arvan, which presents itself as the first content delivery network in Iran, was launched in December 2015 in a conference titled “Explaining Strategies for Developing a Content Distribution Network in the Context of the National Information Network.” Mahmoud Vaezi, then Minister of Communication and Information, was present at the event.

The main idea and existential function of Abr Arvan company is supposedly to “provide cloud security services.”

What is a Content Delivery Network?
A content delivery network, or CDN, is an expansive network of servers which are interconnected throughout various points in the world, so they can provide services to the users, content, and platforms from the nearest points. Basically, the most crucial rule of CDNs is increasing the speed and quality of access to content, as well as bandwidth.

Amir Rashidi, researcher in internet security and access, believes that it is possible that Abr Arvan is the first cloud infrastructure provider and content distribution network in Iran, as it claims to be. Rashidi tells Zamaneh:

“It does not mean that there has never been a cloud infrastructure in Iran, but technologically, regardless of what they do and to whom they are connected, this company is unique. Its services are conclusively in one set, they have a large team, and they even have foreign clients. Abr Arvan is responding to a need that has never been responded to.”

Regarding the meaning of the word “Arvan,” various sources have provided different answers. Arvan is a Kurdish boy name meaning the “fire keeper.” It is also the name of a village in Qazvin and one of the tribes of Lorestan province. According to other resources, Arvan means agile and strong.

What is Cloud Computing?
Cloud computing means that the source of a software transfers the data and data processing to an external space. Using this system, the users can access apps and data through any device connected to the internet. It is a universal network that preserves data and programs in safe data centers, instead of on physical hard disks. This process increases the capacity and speed of processing and facilitates the data sharing and users’ collaboration. Also, the users can access data safely through their cell phones regardless of their location.

Mehdi Bahadori, Pouya Pirhosseinloo, Farhad Fatemi and Alireza Hashemi are the co-founders of Abr Arvan. The board members are Pouya Pirhosseinloo (“executive captain”, CEO and board member), Keivan JameBozorg (chairman of the board), and Farhad Fatemi (as “technical captain” and vice chairman).

Pouya Pirhosseinloo spoke about the formation of Abr Arvan in an interview with Asre Tarakonesh Monthly:

“We initially raised 300 million tomans (around 70,000 USD), which gave FANAP [the Pasargad Arian Communication and Information Technology Co.] a 37% stock share. Based on Abr Arvan’s revenue, valued 200 million tomans, FANAP is supposed to pay 40 billion tomans. 20 billion tomans has already been paid; the rest will be paid based on Abr Arvan’s future revenue.”

Pirhosseinloo also announced in a live interview that so far Abr Arvan had fundraised in two phases, both of which were carried out by FANAP. He declared that the company raised 300 million tomans during the first phase, despite previously stating they had raised 400 million tomans.

“Traditional methods are inefficient and expensive and cause various cyber problems for companies. My friends and I concluded in our discussions that companies should have access to a sort of adapted security service which equips them against complex cyber-attacks. That is why we strived to provide cloud security services”

Abr Arvan was founded with the help of a 400 million tomans (around 90,000 USD) fund provided by FANAP holding (Pasargad Arian Communication and Information Technology Co). In a live Instagram feed on June 15, 2020, Pirhosseinloo, the CEO of Abr Arvan, announced that the company was worth around 200 million tomans based on its revenues.

Abr Arvan currently has PoP sites (Point of Presence) in various locations in Iran and several foreign countries. A PoP site is the connection point of several networks in one place, usually used for CDN services.


Abr Arvan PoP Sites in Iran and other Countries. photo: Abr Arvan Website


Abr Arvan, FANAP holding, Pasargad Financial Group

Abr Arvan grew quickly and signed clients to substantial contracts, among which were governmental offices and institutions such as the presidential institution, Islamic republic of Iran Broadcasting, ministries, embassies, universities, and government news agencies.


Some of the Clients of Abr Arvan’s Products. photo: Abr Arvan website


This array of various clients is a result of individuals and influential institutions that support this company; this changes the essence of Abr Arvan as a startup right from the start.

Abr Arvan has always been a subset of FANAP holding, and one of its main companies. To truly understand Abr Arvan, one should know its sponsors and the key individuals behind it, those that are at the top of the pyramid of a complex network of companies, holdings, and financial groups.

Mohammad Javad Azari Jahromi, the then Minister of Communication and Information, shared a picture on his Instagram, visiting Arvan Cloud Booth at Tehran International Exhibition on July 19, 2019, high-fiving Pirhosseinloo. Mahmoud Vaezi, the Chief of Staff of Rouhani is present in the mentioned photo as well. Pointing out that Abr Arvan had acquired its first foreign client, Azari Jahromi captioned this photo:

“No loan, no rent, no astronomical budget and no clamor over being national, they developed a crucial infrastructure service, and last night they managed to provide service to more than fifteen thousand Iranian companies and acquire their first international client. Kudos to them!”

This was not the only time that the Minister of Information supported Abr Arvan. Azari Jahromi supported the company via Twitter on March 25, 2018, as a company that could provide “proper infrastructure” in the times of “sanctions imposed by the claimants of internet freedom.” But did Abr Arvan really do all this without any rent?

Tweet translation: “If you need cloud computing services, I introduce Abr Arvan to you. These Iranian young individuals could produce a science-based product and provide a proper infrastructure for startups, in the time of the sanctions imposed on Iranians by the claimants of internet freedom.”

FANAP holding was founded on December 15, 2005, through an investment by Pasargad Financial Group (Pasargad Bank). Pasargad Bank was also founded in 2005, with an official license from the Central Bank of Iran, and a 350 billion tomans fund which was fully paid.

Donald Trump, the then President of the United States, put Pasargad Bank in his Ministry of Finance’s blacklist on October 8, 2020.

Majid Ghasemi is the CEO and one of the founders of the Pasargad Financial Group. According to the Strategic Research Institute, Ghasemi has a PhD in Economics from the University of Southampton and was the CEO of the Central Bank of Iran from 1986 to 1989. He was the chairman of the board of Esfahan Steel Company during the presidency of Mohammad Khatami and has been the deputy of economic research in the Expediency Discernment Council research center since 2013.

Ghasemi started working in the Central Bank of Iran in 1980. He and other board members of Pasargad Financial Group such as Kazem Mirvalad, Ahmad Vadidar, Zabihollah Khazaei, Kamran Ekhtiar, AliAkbar Tafreshi, and Mostafa Beheshti Rooi, have long histories of upper management positions in financial institutions connected to the government.

Pasargad Financial Group has more than 22 holdings and large companies, many of which are chaired by Ghasemi, including FANAP. FANAP holding has more than thirteen subsidiary companies.

As mentioned, Abr Arvan cannot be seen as just another startup, and this is not only because of its connection to Pasargad Financial Group. Mostafa Naghipourfar was the chairman of Abr Arvan from the company’s founding in 2015 until 2018. Besides being the first chairman of Abr Arvan and one of its founders, he is the previous CEO of the FANAP Innovation Center and one of the founders of FANAP holding. He is now the council to the CEO of FANAP holding, and the secretary of the Iranian Association of New Financial Technologies (Fintech). Naghipourfar has been the CEO and chairman of more than 10 companies so far, some of which were subsets of FANAP holding, such as Baran Telecom, Inc.

Naghipourfar is a graduate of Sharif University of Technology, and has been a founder, chairman, and the technical manager of Hatef Company (the designer and manufacturer of Iran’s first ATM).

It is due to these connections that the critics of Abr Arvan believe that this company has used FANAP holding’s rent to succeed. The cofounders of Abr Arvan denied this claim in an interview with Shanbeh Weekly on April 21, 2018:

“It is said that we have used FANAP rent, because FANAP is our shareholder…even if all stocks of Pasargad Bank belong to Execution of Imam Khomeini’s Order, it does not prove anything. Because all FANAP’s stock is 35%, meaning it does not have any management share and does not have any say in important strategic decisions. The reason why the ministries work with us is merely our presence in the market and that we provide better products and services. We have not had any more rent than a company that all its stocks are of the Execution of Imam Khomeini’s Order. Therefore, it has been about our products too, and working with us is because of the quality of our work”.

The cofounders of Abr Arvan deny using FANAP holding’s rent by pointing to its 35% stock and lack of management share (now FANAP has 47% share). Meanwhile, Mostafa Naghipourfar, one of the founders of FANAP, has been the chairman of Abr Arvan since its founding up until 2018 and now owns 2.52% of Abr Arvan’s stock.


This infographic displays the companies affiliated with the Pasargad Financial Group.

All four cofounders of Abr Arvan used to work at a company called Shatel (Shatel Information and Communication Technology Group, where Pouya Pirhosseinloo was the technical director of infrastructure security. Shatelis one of the largest groups active in the field of Internet access services, and Internet communication solutions in Iran.

JameBozorg is currently the chairman of Abr Arvan and a key individual for the company. He is concurrently FANAP’s value-added manager, deputy of strategic development and corporate affairs, and the current vice president of Baran Telecom, Inc. Baran Telecom launched the first Iranian Internet Protocol Television named Aio, licensed by the Islamic Republic of Iran Broadcasting in 2015, while JameBozorg was its CEO.

Some of Kivan JameBozorg’s Past and Present Positions in Various Companies:

– Sadra Novin Naghsh Pasargad, chairman

– Baran Telecom (Barid Fanavar Aryan), vice chairman (Baran Telecom is a subsidiary company of FANAP Holding and is active in IPTV)

– Axon Advanced Technology, board member (production of medical equipment)

– ILIA Fanavar Pasargad, chairman (website design and launch, review and research services, management and entrepreneurship indicator advancement in various areas, and hardware related jobs)

– Apsan Communication and Information Services, CEO (it is one of the FANAP holding). This company works in cellphone services; Hamrah e Aval, Ritel, Islamic Republic of Iran Broadcasting, and Pasargad Bank are its business partners), Pasargad Aryan Information and Communication Technology Ecology Development Company,

– vice chairman since 2020 (Pouya Pirhosseinloo is a board member).

– Danesh Payam Pejvak, previous board member (this company is a subsidiary of FANAP holding and is active in advertisement)

– Yekta Kuknos Pars Distributed Information and Financial Technologies, board member (this company works in information technology area).

– Previous chairman of Rajman (maps and router badges)

Keivan JameBozorg from Abr Arvan company, participated in the 6th election of Computer Guild Organization (Nasr) of the Province of Tehran and was elected as the 7th board member by 1,036 votes.

Contrary to the projected image set by Abr Arvan, its management and the Minister of Communication, this company has developed fast and gained support and giant contracts with institutions, offices, and governmental ministries because of its close and personal relationships with these groups.

Kaveh Azarhoosh, independent internet researcher, tells Zamaneh that Abr Arvan has close connections to figures like Amir Nazemi and Mohammad Javad Azari Jahromi. Consequently, it cannot claim distance from power, and these connections do exist. Azarhoosh maintains that Abr Arvan is present in huge projects because of these links and connections.

Nima Fatemi, information security and privacy expert, observes Abr Arvan’s rent from another perspective, telling Zamaneh that:

“When all the doors are shut and they only let your door open, when all the competitors of Abr Arvan are eliminated, internet service providers (ISPs) presented two different prices for the internet (domestic and international); it is a kind of rent for Abr Arvan.”

Since 2017, the Ministry of Information has instructed the internet service providers to separate the domestic traffic from the international traffic. On this basis, the price of internal/domestic internet or Intranet would become half the price of international Internet. This would entice the users to only visit domestic websites and pay more to visit international websites.

In fact, operators and internet service providers decide which websites and applications should be used, usurping the right from the user. Domestic websites and applications can provide high quality, cheaper, and faster services only when they use domestic infrastructure services.

Nima Fatemi states: “When service providers know that the users are inclined to use their services, they double their prices. As a result, the users use domestic infrastructures, an indirect rent for Abr Arvan.”

Fatemi here points to the internet service provider companies that use international cloud computing and other foreign internet services, and the inflated costs force them to use domestic services against their wishes.

Abr Iran National Project and Rising Concerns about Disconnecting from the Internet

Recent criticism and concerns around Abr Arvan are a result of the treaty between the government (Ministry of Information) and the private sector to implement the Abr Iran national project. This project, launched by Iran’s Information Technology Organization, aims to construct, operate, and transmit an integrated cloud network. On January 13, 2020, this project was introduced as the first cloud operator in Iran. it was introduced In line with the development of National Information Network (National Internet) and the electronic government in a ceremony attended by Amir Nazemi, deputy minister of communications, and two private sector consortiums (Abr Arvan- Fanap and Abr Zas Asiatech).

In fact, Abr Arvan has been chosen as the main operative company in the National Information Network development.

Amir Nazemi, head of the Information Technology Organization, pointing to Abr Arvan and Abr XaaS in Abr Iran project, states that the aim of this project is “to be independent of foreign services.” The teams participating in this project have been granted benefits, namely a 90% discount on bandwidth.

XaaS Cloud Company also started its work as a startup in 2014 in cloud computing services and various products such as data centers and cloud servers.

The Abr Iran project included the development of provincial data centers in eight provinces belonging to the Information Technology Organization. Two winning consortiums were granted contracts to develop cloud infrastructure and services in those areas. Abr Arvan is to develop the infrastructures in five provinces.

The Abr Iran project required 2.4 trillion tomans, five hundred billion of which is provided by the government. The rest of it will be provided by the private sector. The head of the Information Technology Organization also announced that the teams working in the Abr Iran project will be able to use cheap facilities from the Innovation and Prosperity Fund.


The image of the Contract Between the Information Technology Ministry and Abr Arvan Company


The first party in the contract is the Information Technology Organization (affiliated with the Information Technology Ministry) and the second party is Abr Arvan. Article Four demands that both parties “take all necessary measures and provide the required facilities which comply with the conditions of the Steering Committee, to abide by the conditions of the national defense, public security and the authority of the judiciary and other Iranian competent authorities.”

Although it is not exactly clear what the meaning of “national defense and public security” is in the context of the Abr Arvan project, one should pay more attention to phrasing, “the authority of the judiciary and other Iranian competent authorities.” According to Article Four, this wording facilitates the access of all governmental institutions, including the security and intelligence agencies, to arbitrarily ask for any sort of data and information from Abr Arvan. We will revisit this issue later, but Article Four demonstrates the reason behind criticisms against Abr Arvan more clearly.

The first article asks the second party (Abr Arvan) to provide “lawful interception (LI) of all equipment and services if necessary.”

There is no explanation in the contract as to what the conditions of “if necessary” are. It is obvious that the judiciary and competent authorities can require LI after obtaining judicial authorization and going through required legal procedures in certain situations. However, the law has a lot of restrictions regarding interception and spying.

According to Article 25 of the Constitution of the Islamic Republic, “reviewing and not delivering letters, recording and divulging phone conversations and telegraphic messages, telex, censoring and not delivering them, eavesdropping and any spying are forbidden, except by law”. According to Article 582 of the penal code, which is an executive guarantee of Article 25 of the Constitution, eavesdropping and conversation surveillance are felonies, except where the law allows it; the perpetrators will be sentenced to prison or a fine.

Pursuant to the law, any kind of eavesdropping, recording, and divulging information, and spying on personal conversations of any kind are absolutely prohibited. The only exception is when by law and the order of judicial authorities, the situation is related to “protecting national security and public rights.”

Also, eavesdropping and accessing computer data have been criminalized in three sections: unauthorized access, eavesdropping, and computer surveillance. In Article Three of the Computer Crimes Law, approved in June 2009, listening to confidential data or accessing saved or transmitting confidential data in computers, telecommunication systems, or data carriers are considered spying. In case that listening is necessary, “the rule of law and judicial authorization” is required.

In fact, according to the law, even the Ministry of Communications, security institutions such as the Ministry of Intelligence, and the IRGC do not have the authority to eavesdrop in any capacity; they need to obtain authorization when needed. Accordingly, Abr Arvan did not have to comply with Article Three, as in special circumstances that threaten national security, they can limitedly and with a special intent listen to data, like any other country, even democratic ones, by going through legal procedures and judicial orders. That is why the critics believe that accepting this contract is complying with a condition before it happens.

Pouya Pirhosseinloo, the CEO of Abr Arvan, tells Zamaneh about lawful interception:

“Lawful interception does not mean there are interception devices, but it is a universal legal concept that allows the police and national or international legal authorities to access the data of the users who have committed cyber felonies such as fraudulent transactions, illegal access to services and other illegal activities including phishing and child pornography. All operators and service providers across the world are mandated to comply with lawful interception; in cloud infrastructure, this data includes the information of the cloud or domain owners”.

Pointing to the Abr Arvan transparency report, Pirhosseinloo states: “There has been no software or equipment linked to legal or security authorities, aiming to save or intercept, in any point of the Abr Arvan network.”

Responding to other criticisms, Abr Arvan asks that since they are just a cloud service provider, does this mean they cannot build a data center? Does building a data center contradict with their claim about not “shutting down the internet”? He claims that they are only a device provider and have no responsibility about how the device is used.r

Amir Rashidi, security and internet access researcher, explains that Abr Arvan can build a data center, but they did not have to commit to cooperating with government organizations in advance, to eavesdrop, shutdown, or provide data and information to governmental organizations whenever necessary.

“They may say that this is Iran, and the circumstances are different from other countries. I would say do it if you have to, but do not sign such a contract. Let them force you to shut down the Internet, why would you agree in advance with a contract that you would shut down the Internet whenever they ask you to? Technology companies should implement the universal principles of users’ rights protection regardless of the attitude of different governments. There are many companies in Iran which provide hosting services; would all of them sign such a contract?”

Nima Fatemi, privacy and information security expert, emphasizes that what Abr Arvan is providing is not essentially bad, but it becomes worrisome when in a project like Abr Arvan, the company signs a contract and in advance is willing to facilitate lawful interception. According to its content, surveilling the users using their services, disconnecting them from the Internet, and reviewing the users’ history becomes possible.

Responding to the criticism, Abr Arvan emphasizes that this issue is only applicable in special circumstances and after going through judicial procedures. Even without the lawful interception stipulation of the contract, only in special circumstances and by the order of judicial authorities (including in free countries), does user information get delivered to related organizations and authorities.

Kaveh Azarhoosh, independent internet researcher, tells Zamaneh that Abr Arvan contract reinforces the suspicion that this company has close connection to the government. With this contract, Abr Arvan is building the governmental internet infrastructure with a clear “political orientation.” Azarhoosh also ponders whether these companies are shareholders and political partners of internet infrastructure or not, regarding this very issue as the main knot of this story with Abr Arvan:

“In democratic countries, the government does not politicize infrastructure building, therefore, it makes no difference whether the company is private, public or semi-private. We know the deal in any case, and we know in what structure they work or what responsibilities and powers they have. But when we are talking about countries like Iran or Russia, and as we are at a historic point when they are deciding on cloud infrastructure and the future of the internet, when we see a private or semi-private company, the main clients of which are governmental or it has close relationship with the government, we can be suspicious of some policy makings. We think about what the government is pursuing in infrastructure building and the architecture of the internet.”

Amir Rashidi also points out that the stipulations in the Abr Arvan contract damage user privacy, as they aid organizations and the Iranian government to shut down websites and the internet without any legal procedure.

Jadi Mirmirani, programmer, discusses Abr Arvan and the mentioned project in Episode 12 of Radio Gig Podcast. He points to novel ways in filtering and internet restriction such as the National Information Network, “Shoma,” saying, “we live in our beloved country, and nothing can grow and become a reliable information resource and stay independent at the same time.”

Jadi regards this contract as unprecedented in the world. According to legal interception stipulations, there is “backdoor access” to any ISPs, granting the government the ability to shut down services at any time. Jadi sees the role of companies like Abr Arvan as “facilitating the intranet idea, promoting Iran’s disconnection from the world, and reducing the cost of internet shutdown for the government.”

Jadi, responding to Abr Arvan’s claim that they only provide the services and equipment, states that when there is freedom, equality, and independence, you can make these kinds of claims. But when a mad man goes to a knife shop dragging someone else by the collar, do we sell them the knife just because selling knives is our job, although we know the mad man may kill the other person?

Reviewing the rest of Abr Arvan contract, we see that according to Clause B, the contract parties are responsible for “shutdown management, connection, establishing restrictions and implementing short and long-term policies, enforcing policies and security standards, also mining all sorts of data banks in the network and communication and telecommunication services.” This clause does not specify the purpose of data mining, why it is included, or to what end. Furthermore, Clause B makes it easier for the Ministry of Communication to misuse the integrated cloud infrastructure to restrict or shutdown the internet for any reason, the infrastructure which is supposed to be built by Abr Arvan.

Clause H, a supplementary clause for Clauses A and B, guarantees that those clauses are implemented on any point the first party (the Information Technology Organization) chooses; Abr Arvan is obligated by this clause.

Next, paragraphs two to four require Abr Arvan to assist the pertinent organizations in protecting security and intelligence at once. Paragraphs three to four again makes it imperative that Abr Arvan does “shutdown or change service providing” in accordance with laws and regulations, “without any delay,” and acts as the “order of the first party and other authorities.” According to the definition of the Abr Arvan project, it is supposed to contribute to “building, applying, and transmitting the integrated cloud network distribution” in line with the National Information Network. In other words, according to these contract provisions, any governmental organization including the judiciary to Information Ministry or IRGC, etc. can have easy access to internet shutdown services and there is no legal barrier against them.

Another question that comes to mind: if Abr Arvan’s project is about improving the internet conditions in Iran, why should they commit the contractors to shutting down and disconnecting the internet services in advance?

If we accept the claim of the head of the Information Technology Organization that the aim of Abr Arvan project is “independence of foreign services,” and put it in the context of 98% internet shutdown by November 2019, it is easy to understand the users’ concerns and their criticism against the Abr Arvan project.

Abr Arvan rejects these concerns and allegations all together. But the anxiety about a nationalized internet and giving rent to companies that work with the Communication Ministry to implement this project are still very serious. Abr Arvan has always announced in various announcements that “filtering and internet shutdown” are lines that they would never cross, and that they are against any rent, lack of transparency, and the misuse of national resources. Abr Arvan says that the Abr Arvan project will set up five data centers in Tabriz, Karaj, Shiraz, Isfahan and Ahwaz.

Filtering, Internet Shutdown and Cloud Infrastructures

Abr Arvan announced on January 14, 2021, that the word “internet” would be replaced with “World Communication Network.” Abr Arvan explained that technically, the phrase “being dependent on the international internet” (quote from Amir Nazemi, the head of Information Technology Organization), points to increasing domestic traffic that is transmitted from neighboring countries.

Amir Rashidi, internet access and security researcher, thinks Abr Arvan’s explanation is partially true, but emphasizes that there is an important issue that they fail to explain; the national internet is not just internet traffic. He notes that there is no clear and correct impression of the national internet, and these important issues should not be overlooked.

Rashidi explains that:

“The National Information Network launched in 2009, although the need for a national internet was being discussed in the last years of Khatami’s presidency. If you talk to network experts, the experts that are experienced in designing wide range internet networks, they believe that a healthy internet should be able to transmit data to users in the shortest and cheapest way. This means that we should shorten the routes across cities and the country as much as possible. Actually, the idea of national internet started with this very idea. The Ministry of Information built infrastructures with this idea in mind, something that did not exist before Rouhani’s government. Although this infrastructure transformed internet access in Iran, in dictatorships like Iran where there is no transparency, accountability, or the rule of law, it becomes a double-edged sword. The people who manage and make policies about this network would use it as a repression tool, although it is technically more advanced.”

According to Amir Rashidi, the National Internet has two parts. Hardware infrastructure (cable, server, data center) and software (a collection of services and applications like email, search engines, messengers, etc.). He explains the role of companies like Abr Arvan:

“Abr Arvan claims that they do not have any role in internet shutdown, because they themselves are internet users. That is true but the point here is that the National Internet is not just traffic, but national messengers, national data centers, national email, and cloud infrastructures, etc. And what they are doing, knowingly or unknowingly, is providing these tools and cooperating in this project”

Nima Fatemi sees deleting data, in addition to filtering, as the most concerning issue regarding building infrastructures while working with the government:

“When they want to filter a website, they can concurrently ask an ISP to delete their data from their website forever. If the data is on foreign servers, they can only filter the website while the data stays untouched and accessible through circumventing tools”.

This privacy and information security expert adds that when the data is on a domestic cloud infrastructure, they can collect users’ information, and the information of people who use that website/data/services.

In the event of another internet shutdown, such as the shutdown in November 2019, the users on the National Internet infrastructure would not notice. When using national messengers, emails, data centers, etc., users can still access the internet and necessary services, albeit restrictively and in something like a parallel universe. At the same time, accessing and controlling users’ private data would be much easier. As a matter of fact, users’ right to a free internet and freedom of choice would become limited.

“When businesses, banks, etc. do not need the international internet whatsoever, when the government decides to shut down the internet, they can shut down the international/foreign internet (like what happened in November 2019) and keep the domestic internet open, since they have separated the domestic and foreign data. In this case, people inside of Iran feel less of a change in their lives. The only change they feel is that they cannot access foreign websites and emails, but they can use domestic websites and apps. As a matter of fact, internet shutdown becomes less perceptible and has fewer financial consequences for the government”.

Azarhoosh sees Abr Iran’s goal of lower dependence on the global internet network as in line with the approvals of the High Council of Virtual Space, such as the Internet Master Plan:

“We cannot say that this contract was signed in a vacuum; it was not, meaning that Abr Arvan sees the same issues seen by me and other activists inside of Iran who are against this contract. This contract makes Abr Arvan an accomplice in localizing the internet which is far more dangerous than filtering a data center. Because localizing the internet facilitates internet shutdown and has worse consequences like eavesdropping and spying on the users. And when the users feel more surveilled and controlled, they self-censor more.”

According to Azarhoosh, there are a lot of companies that are not partners in building internet infrastructure. So, when a company like Abr Arvan becomes a partner to the government to build a National Internet infrastructure, they cannot claim that internet shutdown is a “line” they will not cross. Nor can they claim that since they have no authority, they have no accountability. As long as these companies are the financial partners of these sorts of projects, they cannot claim that they will be affected by internet shutdown like others.

Farzad, an employee of Abr Arvan, posted a response to a user named Hamed, trying to explain that the criticism was not based on truth. Farzad explains his points in three parts: the technical necessity to a local network, improbability of internet shutdown, and inept journalism.

Nima Fatemi considered the explanation as “an insult to the general public and the experts.”

Repeating November 2019?

Four months into Rouhani’s second presidential term in 2015, he stated in the National Assembly Report on Citizens’ Right that his government supported internet freedom and social media. He also criticized spying on and controlling the private lives of the citizens, saying: “The Communication Minister promises the public that he would not filter the internet.”

But contrary to this promise, on the night of November 16, 2019, the second night of the November nationwide protests, the Ministry of Communication shut down the internet by order of the National Security Council. Because of the disconnect between the people inside of Iran and from the outside world, security forces could suppress the protests faster, easier, and with more intensity and bloodshed.

Abr Arvan described the internet shutdown in November as “unprecedented and unbelievable” in a report titled “Reporting a Nightmare, Iran without Internet for 160 Hours.” While there was a 98% internet shutdown across the country, Asia Tech, Afranet, and Mobinnet had partial internet access. Domestic servers of Abr Arvan are in Asia Tech data centers, which is why it was among the few companies that had internet access in November 2019.

Using this small window, Abr Arvan resumed providing services to some of its sensitive clients during the November 2019 upheavals, later explaining that it was the only solution for businesses.

“Minutes after the almost total internet shutdown on Saturday evening, our technical team started to connect to the internet using the only data centers who had international internet. The most obvious solution was to advise the businesses in trouble to migrate their out-of-country servers to the Abr Arvan cloud computing infrastructures. But Abr Arvan preferred to find a technical solution to lessen the changes and costs for businesses.”

In the end, Abr Arvan tried to lead the international internet traffic of the data centers without internet to the connected data centers, using “smart routing.” This was in place of “the most obvious solution,” which was migrating international servers to domestic servers. However, what is apparent in this report is that Internet shutdown can happen again, so the best thing to do is to migrate servers inside and use Abr Arvan’s cloud computing infrastructure.

Abr Arvan’s Licenses

◾️ The Samta (Ministry of Defense) license
The Center of Organizing, Management, and Empowering Partners’ Network (Samta) supervised by the Ministry of Defense is the only official reference to connect the private sector to the government. Entities with Samta licenses are capable of signing contracts with organizations and institutions affiliated with governmental and military networks.

◾️ Certificate of Competency from the Passive Defense Organization
This certificate is considered as a qualification to act in the area of security council services and cyber defense. The Passive Defense Organization is a subsidiary unit of the General Staff of the Armed Forces. This institution was formed in 2003. This organization is a governmental institution (military and national).

◾️ Afta license
Afta license (Production Space and Information Exchange Security) is issued by the Information Technology Organization. Based on the Ministry of Communication’s order and the Afta document, companies operating in the field of information technology are obligated to obtain an Afta license.

Also of note, if there are projects that can facilitate the control of the internet by the government, in what capacity are they in line with the aim of the Communication Ministry in convincing companies and websites to migrate their servers inside of the country? In a country like Iran, where everything is controlled by the government, what dangers are produced for companies and businesses by migrating servers inside? Should businesses or websites not have the free choice of keeping their data anywhere they want?

Internet control and lessening the need for the international internet have always been a concern for the Islamic Republic of Iran, and they have long been trying to achieve this capability. The Passive Defense Organization and Shaparak (the electronic card payment network, affiliated with the Central Bank of Iran) were supposed to hold the “internet disconnection maneuver” on February 28, 2017.

Commander Gholamreza Jalali, the head of Passive Defense Organization, had said that this exercise aimed at creating an “Iranian Islamic internet.” According to him, defining “infrastructural privacy, thematically and spiritually” was a real necessity for Iran. The goal of this maneuver was reportedly to study the situation of internet shutdown. But in the days leading to this event, a letter from Sedad company and Shaparak Company was published in the media and on social networks, in which it was suggested that companies should migrate their servers inside because of future repeated internet shutdown maneuvers.

This created more concerns about the government and other organizations seeking to control and shutdown the internet, as well as forcing businesses to migrate their servers inside the country. This concern was exacerbated by specific parts of the letter, parts of which were published in Tasnim News Agency: “in the near future, this maneuver will happen repeatedly, and eventually, all acceptors that have servers outside of the country will be removed from the payment service.”


Sedad’s Letter to the Companies Using its Services Regarding the Internet Shutdown Maneuver and Migrating Servers Inside


Nima Namdari, vice president of development and innovation of Ertebate Farda electronic business company, stated in an interview with Hamshahri newspaper that this maneuver aimed to “prepare the minds of the users for the future” when “using virtual private networks (VPNs) will be more restricted.”

Eventually, after much objection, this maneuver was canceled. Azari Jahromi, the Minister of Communication, implied that the reason behind this maneuver was to “examine the resilience of the banking infrastructures facing the sanctions.” He stated that there were other methods for this examination, and the Sedad company did not have the authority to force companies to migrate their servers inside.

Returning to Abr Arvan’s report about the internet shutdown in November 2019, it reads:

“Routing solution could respond to the needs of the businesses till 3 pm on November 17, but after Afranet and Mobinnet data centers were disconnected for half an hour, the connection was lost altogether. Using the only remaining way in Asia Tech and regaining the mentioned datacenters, Abr Arvan was able to connect all businesses to the internet.”

Pouya Pirhosseinloo, the CEO of the company, stated in an interview that anyone asking for a car from Tapsi and Snap, buying tickets from Tiwal portal, or using internet bank services is inadvertently using Abr Arvan’s services, and the data will transfer through their centers one way or another.

Per Abr Arvan, using internet banking equals using Abr Arvan services. This company is the only holder of an Afta License and Passive Defense License, which grants them complete approval for supplying cloud security products and services in the country.

According to the same report, Abr Arvan received a high volume of requests from big businesses so that they could have a stable connection while the internet was still down in Iran. From November 17 until the end of the internet shutdown, five thousand new domains were activated on Abr Arvan’s cloud infrastructure. It was the result of shutdown anxiety that the businesses were forced to use domestic services and stay connected.

A little time after the upheaval of November 2019, and the sudden increase in clients, Abr Arvan increased its prices. Having this in mind, one should ask, did Abr Arvan have internet connection rent then (a rent that gives it the capability to serve its customers)? And did it not use the internet shutdown to self-promote and become more known?

The data centers where Abr Arvan’s servers are kept had internet access in November 2019. Nima Fatemi explains that we cannot say with certainty that it was on purpose or just a coincidence.

Kaveh Azarhoosh states that the next shutdown will be different from what happened in November 2019. Because infrastructures have been made and the conditions may dictate that companies like Abr Arvan with international partners have internet access during the internet shutdown.

Amir Rashidi adds that during the November shutdown, three groups had access to the internet: embassies, newsrooms and sensitive offices such as the police, and a group that was given internet without filter by Azari Jahromi, consisting of about three thousand people.

Indirect Contribution of Sanctions to the Nationalization of the Internet in Iran

Iran’s government seeks to convince websites and applications to migrate their servers inside by restricting access to the international internet and building the National Information Network. After the November 2019 protests, this issue became more serious. On the other hand, some of Trump’s sanctions accelerated this process.

U.S. sanctions ban internet companies’ business interactions with Iran and the U.S. Department of the Treasury asks big internet companies to have a D1 permit before selling “personal communication tools and services” to Iranian users. The U.S. Department of the Treasury’s reasoning is that internet products have a great role in supporting freedom of speech in undemocratic countries.

But even with the D1 permit, internet companies essentially refuse to sell to Iranian users; they are worried about possible breaches of the sanctions that are beyond D1’s complicated and limited conditions.

Nima Fatemi tells Zamaneh about the effect of internet sanctions:

“Trump’s government convinced the American and international cloud computing companies to close the accounts of Iranian users by imposing maximum pressure sanctions. It made a lot of companies and Iranian entrepreneurs to migrate their servers inside in order to continue their activities, even though they did not trust domestic cloud infrastructure companies.”

According to Fatemi, this resulted in the government being able to control the data in the domestic infrastructures more easily. On the other hand, when the government shuts down the internet, these domestic websites are still active.

This raises two significant concerns. On one hand, the power of free choice and users’ access to internet services will be restricted. On the other hand, when the Iranian users have no choice other than using the domestic internet’s products and services, it will be easier for the government and security institutions to censor and control the internet. In a nutshell, the users’ security and privacy will be compromised.

For instance, due to the internet sanctions, Google, which is one of the greatest internet service providers, especially in cloud computing, has blocked all Iranian IP addresses and no user from Iran can use Google’s special services.

According to Nima Fatemi, large internet corporations like Google restrict Iranian users even more than official sanctions:

“Google has installed more advanced detection systems that even if the users use VPNs and want to visit websites that keep their data on the Google cloud, they will still be blocked by Google. It is beyond what the U.S. sanctions have asked the technology companies”

Amir Rashidi also emphasizes that before the sanctions, Iranian users had no trust in domestic internet services and programs. But after the sanctions and seeing their access to international internet services being blocked, they began using domestic services more.

Among other concerns of free access to internet activists is that if the data is on domestic infrastructures, there is no way to preserve them.

The Campaign for Human Rights in Iran published a report titled “Supporting Secure Access to the Internet for the Civil Society in Iran” on April 22, 2020. The report deals with the problems the Iranian users face in order to have access to and use modern technologies due to the U.S. sanctions. Based on this report, the restrictions have increased the vulnerability of the Iranian people against the government’s surveillance and censorship.

This report also points out that the present conditions lead the Iranians to use domestic products which are supported by the government and the government blocks whichever websites it wants.

Abr Arvan’s Response to Zamaneh

Abr Arvan stresses that their endeavor to build a National Internet infrastructure does not mean they want to restrict international internet or block it; if it were their goal, they would not have strived for technology development.

These two claims are unrelated and not mutually exclusive. Also, one should have in mind that internet shutdown, restriction, or decreasing the need to the international internet require domestic internet development and its infrastructures.

In this regard, Zamaneh tried to contact Abr Arvan for a response to the criticism. Zamaneh asked the following questions:

◾️ Abr Arvan has called the National Internet a “grim” phenomenon. In case the international internet is shut down because of it, how do you define the National Internet?
◾️ If there should be other protests like those of November 2019, and we see another 98% internet shutdown, and the National Internet can still provide services, do you not see this as blocking the international internet?
◾️ Abr Arvan has announced several times that filtering and internet shutdowns are the “line” they will never cross. Where exactly is this line?
◾️ There are clauses in the Abr Iran contract that require Abr Arvan to divulge servers’ data and users’ data to the governmental organizations. You claim that this only will happen in extraordinary circumstances, and with the request of judicial authorities. Many of your critics say that in case of extraordinary circumstances in any country, this will happen after legal processes and necessary judicial permits, so there is no need for companies to make this commitment in advance. What is your answer?

Pouya Pirhosseiloo, responded to Zamaneh’s questions via email. Zamaneh’s questions were mostly based on Abr Arvan’s published announcements. To be fair and give Abr Arvan an opportunity to be accountable, Zamaneh will publish their exact answer here.

Read Pouya Pirhosseinloo’s complete answer here.

Pouya Pirhosseinloo, answering Zamaneh’s questions, points out that the internet shutdown in November 2019 had nothing to do with Abr Arvan (Zamaneh has never claimed that it had). He also insisted that they were the only company that reacted to the shutdown.

He sees the National Internet as a “strange creature” that is “the most important cultural consequence of the disturbances of November 2019.” He considers the National Internet two contrary words, the whole technical support of which is “creating geographical restriction in a network and nothing else.” He also thinks of this process as destructing “what online businesses and startups have built slowly, arduously, and with great hope.”

At the end, Pirhosseinloo presents two questions:

1- Arvan believes that it has no direct or indirect impact on internet restriction. But let us suppose that it does:

– What is the role of the government (Parliament, High Council of Cyberspace, Security Council, etc.) as a policymaker?
– What are the roles of the state, communication ministry and the infrastructure company (which has a monopoly on the internet)?
– What are the roles of mobile operators and landline operators which distribute the internet?
– What is the role of the data centers which provide services to Abr Arvan?
– What is the role of other cloud operators (there are tens of cloud companies in Iran)?
– What is the role of large private and public companies from banks, internet shops, big food platforms, transit, gaming platforms, etc. that are hosted in Iran without any cloud services?

Do you think the media reflects on these issues?

2 – Let us suppose that one day we decide to destroy all cloud companies, what is the next step then? We probably should destroy all data centers. The next step? Destroy all domestic internet exchange points. Ultimately, we reach a point that all traffic inside the country is gone.

Do you not think that the internet costs will increase by ten times and that the Iranian people will have to use the same old 128 kb internet? Do you not think this causes the loss of the internet in remote areas? And do you not think the dependency of all people to the internet will decrease and consequently the internet shutdown will be less costly then?

There is no direct answer to Zamaneh’s question in Pirhosseinloo’s response. The writer of this report never said anything about destroying cloud companies, nor did the critics of Abr Arvan. The key and clear question is still this: what is the role and place of these companies in the projects which may lead to internet restriction, filtering, and shutdown?

***

Our appreciation to Payam Elhami for his contribution to this report

The Evolution of the National Internet in Iran, a Response to Public Protests

🔳 Launching the National Information Network was a pursuit of Ali Khamenei, the Supreme Leader of the Islamic Republic. According to Reza Ameli, secretary of the Supreme Council of Cultural Revolution, planning the National Information Network cost 12 trillion tomans until 2019.

🔳 In the last few years, the state has intensified its attempt to launch the National Internet Network as a “reaction,” a reaction to widespread public protests which started in 2009 and are occurring with greater frequency and intensity.

🔳 The idea of a “national” internet network started during Ahmadinejad’s presidency. He implemented the “High Council of Information Technology,” which was designed in the last year of Khatami’s presidency. He announced in the first session of the council that “the National Internet Network” had been generally approved. A year earlier, before signing the articles of association of the newly established council by Mohammad Reza Aref, the then vice president, one of the first cases of internet activists’ suppression occurred:

The Bloggers’ Case

🔳 Facebook and Twitter were instrumental in spreading the news and organizing the 2009 protests, accelerating the state’s plans. Developing the National Internet Network entered the fifth development plan in 2010 and within a year, Ali Khamenei formed another council, the High Council of Cyberspace, when he lost hope in the High Council of Technology.

🔳 The main difference between the High Council of Cyberspace and the High Council of Technology was member composition. The latter was completely the government’s domain and the former consisted of individuals close to the leadership, the heads of two other branches of the state, commander of the Islamic Revolutionary Guard Corps, the police and the Islamic Propaganda Organization.

🔳 The reformists of the Green Movement voted for Rouhani in the 2013 presidential election. Although the new president talked about more internet freedom, the launch of the National Information Network (in place of the National Internet network) was approved, with the same agenda and the same budget of 100 billion tomans in the 15th session of the High Council of Cyberspace in March of 2014. In the second mandate, paragraph two, one requirement of the National Information Network was defined as: “a completely independent and secured network compared to other networks (including the internet) with the ability of managed/controlled interaction.”

🔳 The media repeatedly reported about the disputes between Rouhani and the High Council of Cyberspace. Eventually, Khamenei interfered and called for the dissolution of the High Council of Technology in favor of the High Council of Cyberspace in a mandate on September 6, 2015.

🔳 The Supreme Leader called for an “acceleration in launching the National Information Network after it was approved in the High Council, and constant and active supervision on the national center on its launching and operation.”

🔳 The High Council of Technology, which represents the power of the government in cyberspace, despite Khamenei’s order, continued to exist. However, there were endeavors to justify its parallel existence.

🔳 The protests of January 2017 rattled the state once again. Telegram was filtered and domestic messengers thrived. More domestic apps were being developed concurrently.

🔳 But the November of 2019 frightened both the government and the conservatives close to the leadership. The Internet was down for several days. Rouhani’s cabinet, which had promised to stop filtering the internet, approved the Articles of Association of the Information Technology Executive Council on November 17, 2019. This council is obligated by the High Council of Cyberspace’s approvals, meaning the launch of the National Internet Network.

🔳 Hassan Rouhani, during the budget meeting of 2020 on December 8, said unequivocally that per Ali Khamenei’s order, the government will reinforce the National Information Network to “be independent of the foreigners.”

🔳 Rouhani stated that Khamenei’s order was recently issued. Its coincidence with the November upheavals shows the real reason behind it.

Source » radiozamaneh

You may want to read