“Crowdsourced” Espionage: a New Strategy of the IRGC for Tighter Digital Repression
A review of the Islamic Republic’s digital surveillance patterns in suppressing citizen, building political cases, threatening citizens’ safety through digital tools


After the bloody crackdown of Jan 2025 and the beginning of the U.S. and Israeli war against Iran, the Islamic Republic adopted a new method for digital surveillance of citizens. Relying on the law titled “Intensifying Punishment for Cooperation with Hostile Countries Against National Security,” which had been passed after the 12-day war, some people were arrested and executed merely for sending images and videos to media outlets.
For years, whenever internet freedom and digital security were discussed, people’s minds immediately went to filtering. But the issue is no longer only what the government censors for citizens, it is how the government tries to watch citizens’ own digital behavior and use it against people at the moment.
In its new model of repression, the Islamic Republic targets exactly this point. It shuts down the internet, criminalizes sending videos to foreign media under the label of “espionage,” and at the same time sells domestic repression to foreign audiences as a war against an external enemy while destroying the flow of information. On the other hand, the state itself has access to non-public data. This is why citizens and journalists need open-source intelligence (OSINT) to understand the truth. But the government can make this path difficult by cutting access, creating fear, producing an official narrative, and using hidden data.

The image of the protester sitting in the middle of Jomhouri Street in front of the Special Unit is a clear example of this situation. Very quickly, versions of screenshots from this video circulated on social media, some of them enhanced or manipulated with artificial intelligence. The Islamic Republic quickly arrested the person who filmed the video and issued a 10-year prison sentence against him.
If we look closely at the viral video, the reflection of piano keys can be seen in the window of a musical instrument shop. Since we already know that the image was taken on Jomhouri Street, the person filming can be identified quite easily. This is why, before publishing anything, any information or data that could create danger must first be removed.
Domestic Messengers: The IRGC’s Tool for Digital Repression
Another example is the appearance of channels titled “Spy-Finder” or “Mercenary-Finder” on some domestic messaging apps and social networks. Seventeen days ago, the IRGC Intelligence Organization announced that “under the law on confronting hostile actions by the Zionist regime, any form of cooperation with the enemy, including preparing and sending videos and photos, is considered a criminal act and perpetrators will be dealt with under wartime law.” Even several IRGC-affiliated news agencies, such as Jamaran and Mehr, encouraged people to report “spies” through these channels.
In these spaces, any citizen can report someone as an “infiltration agent.” Sometimes a person’s image, name, place of residence, workplace, phone number, or social media accounts are published. Sometimes even a single accusation is enough to expose someone to threats, online attacks, or social pressure.
| Publishing Platform | System Name | Number of Followers | Nature |
|---|---|---|---|
| Eitaa | Spy-Finder / @jasosyab | 99.3K | Contact with the channel’s own admin is mentioned. |
| Rubika | Spy-Finder / @jasosyab | 22K | People are advised to contact Police 110. |
| Bale | Mercenary-Finder / @jasosyab | 1.8K | A communication gateway to the Basij and IRGC Intelligence News Headquarters 114 is visible in the channel. |
At the moment, the greatest danger of digital repression in Iran lies in the connection between tools. A hijab-reporting app, a spy-finder channel, or a SIM card registered with a national ID number may each seem limited or explainable on their own. But when these are connected, the picture changes. All of them can become part of a chain that may eventually lead to someone’s execution.
Until now, the issue seemed to be only “the hacking of political activists’ phones.” But now the lives of ordinary citizens are at risk. Digital repression is not only about “platforms being filtered,” and the Islamic Republic tries to minimize the issue by reducing its importance. Today’s concern is not only “Instagram” or “Twitter.” Digital repression has put our lives in danger, and the ordinary tools of everyday life are being turned, one by one, into instruments of control.
Crowdsourcing Repression Models of IRGC
The image of the man sitting during the protests is only one part of the Islamic Republic’s new model of repression. Recently, systems affiliated with the IRGC have heavily promoted identifying people through the same method. In other words, anyone, from anywhere, can help build a case against citizens. This points to a pattern of crowdsourced digital repression, one of the most important examples of which is the “Nazer” application: a system affiliated with FARAJA that turns society itself into an official tool of repression and into the state’s reporting eyes and ears.
Mandatory hijab has for years been one of the Islamic Republic’s main tools for suppressing people. But in recent years, this issue has no longer remained limited to street confrontations or the morality police. The government has tried to connect control over women’s bodies to data-driven and digital tools. In other words, a chain is being built that begins with a woman’s body in the street, connects to a police text message, and can ultimately end in punishment or pressure.
The issue is no longer only “controlling hijab.” It is about turning women’s bodies into data that can be recorded, processed, tracked, and punished. In this model, the government does not always need to have an official officer at the scene. It is enough for one person to submit a report, for one license plate to be registered, and for the system to take the rest of the path. An infrastructure that is being normalized today under the title of hijab can tomorrow be used by the government to treat protest and lifestyle as threats. Until now it was for hijab; now it can be used for any other behavior.
The government no longer needs to be physically present everywhere. It can build a network of informants, applications, text messages, and databases. The result is a society in which people are not only afraid of officers; they are also afraid of being seen by others. If this fear becomes normalized, it deeply destroys individual and social freedom. Freedom is not only about whether we are legally allowed to do something or not. Freedom means being able to live without the constant fear of being recorded, reported, and punished. Citizen reporting is no longer a security tool. It is a tool of fear.
January 8 and 9: When Street Repression Was Completed by Digital Surveillance
The crackdown of January 8 and 9 did not move forward only through bullets, arrests, and the presence of security forces in the streets. The Islamic Republic also tried to control the narrative at the same time. In other words, it did not only target protesters’ bodies; it also blocked the path through which repression could be seen. In such moments, digital repression takes on a complementary role. At the moment of repression, people’s phones are not merely communication devices for the government; they are threats. A phone can create evidence, send video, challenge the official narrative, and make public a scene the government wants to hide.
In a normal country, filming state violence can serve as evidence of human rights violations. But in the Islamic Republic’s narrative, the same video can be framed as “sending information to the enemy.” The result is that people become afraid not only of being in the street, but also of recording the truth.
This process was reinforced through legislation as well. The law on “Intensifying Punishment for Espionage and Cooperation with the Zionist Regime and Hostile Countries Against National Security and National Interests” expanded the definition of espionage and cooperation with the enemy to an unprecedented degree. Under the text of this law, any informational, media, or technological communication with the United States, Israel, or other “hostile states” can be met with heavy punishment, even execution. Mehrdad Mohammadinia and Ashkan Maleki were among those arrested during the Jan 2025 protests and were executed on June 1, 2026, under Article 1 of this law.
Amnesty International has reported that after the beginning of the U.S. and Israeli attacks on Feb 28, 2025, authorities of the Islamic Republic used the label of “wartime conditions” to arbitrarily arrest more than 6,000 people, and at least 127 political executions were carried out during the same period. The Center for Human Rights in Iran also reported at least 22 political executions over a six-week period, from Esfand 27 to Ordibehesht 7, ten of whom were among those arrested during the January protests. These numbers show how the Islamic Republic turned a political and wartime crisis into an opportunity to accelerate repression, build cases, and carry out death sentences.
The crackdown of January 8 and 9 showed that, in order to make the situation appear “normal,” the government does not only need media censorship. It also needs to cut people’s communications, make videos reach the outside world later and with more difficulty, and discredit every independent piece of evidence by labeling it espionage. This is why the citizen’s phone, at the moment of repression, becomes part of the battle over narrative. The government knows this well. That is why, on one side, it shuts down the internet, and on the other, it turns sending videos into a security crime. The result is a society in which people are afraid not only of bullets, arrests, and executions, but also of recording the truth. This is the deeper meaning of digital repression: reality is silenced before it can be seen.