“Systematization” versus “Organization”
A dispute between the government, parliament and the Supreme Council of Cyberspace exposes the fragmented authority behind Iran’s internet governance—and gives new meaning to Ali Khamenei’s complaint that cyberspace is “truly left unchecked.”
On August 26, 2026, a second draft of Iran’s proposed “Cyberspace Systematization Bill” was circulated among members of parliament for consultation.
Read the draft Cyberspace Systematization Bill (PDF, in Persian)
The five-page draft, reduced to eight articles from its previous version, drew mixed reactions. The Ministry of Information and Communications Technology objected to its structure and substance, while several lawmakers said a joint parliamentary committee was continuing its review. Hossein-Ali Haji-Deligani, one of the bill’s sponsors, said the committee had approved its general principles and was examining the individual provisions.
Related Articles
The proposal follows an earlier attempt by President Masoud Pezeshkian to reorganize internet decision-making through a “Special Headquarters for Organizing and Steering National Cyberspace,” chaired by First Vice President Mohammad-Reza Aref. Some members of the Supreme Council of Cyberspace opposed the new body, and the dispute over institutional authority reached Iran’s Administrative Justice Court.
Behind this latest confrontation, however, lies an older structure: three high commissions established under the Supreme Council in 2012. Their powers have been revised repeatedly over the past fourteen years. The regulatory commission became widely associated with the controversial “Protection Bill,” known in Persian as Sianat. The other two—the security and content commissions—have received far less attention.
Their history suggests that parliament’s latest proposal is less about creating a new system than consolidating and expanding an architecture of internet governance partly outlined in the earlier Protection Bill.
Reorganizing Internet Governance
Supreme Leader Ali Khamenei established the Supreme Council of Cyberspace by decree in March 2012. Its stated purpose was to create a central authority for policymaking and coordination among the many institutions involved in governing cyberspace. Fourteen years later, the Islamic Republic continues to establish new councils, headquarters and working groups to resolve disputes among those institutions.
This proliferation is more than an administrative problem. During successive crises—including nationwide internet shutdowns in November 2019 and January 2026, and extensive restrictions in 2022–23 and 2026—various bodies have been identified as participants in internet decisions. They include the Interior Ministry’s National Security Council, the separate Supreme National Security Council, the National Cyberspace Center, and security and telecommunications agencies.
Yet the boundaries of their authority and the final chain of decision-making have remained unclear, particularly when it comes to disconnecting and restoring internet access.
In April–May 2026, Pezeshkian established the special headquarters with a mandate to end overlapping responsibilities and conflicting decisions. Four individually appointed members of the Supreme Council—Kamyar Saghafi, Reza Taghipour, Rasoul Jalili and Mohammad-Hassan Entezari—filed a complaint, arguing that the headquarters encroached on the Council’s remit. The Administrative Justice Court subsequently issued an interim order suspending implementation of the disputed decision.
The Systematization Bill addresses precisely this struggle over authority. Article 2 designates the National Cyberspace Center as the “command center for cybersecurity operations.” Article 3 makes the creation of new bodies conditional on either parliamentary legislation or authorization from the Supreme Council.
The same article proposes another joint working group to coordinate the Supreme Council of Cyberspace, the Supreme National Security Council and the Supreme Council of the Cultural Revolution, an influential body responsible for cultural and educational policy. A bill presented as a solution to competing centers of authority would therefore add another coordination structure to the system.
The dispute also has direct consequences for how government institutions communicate with the public. On September 6, 2026, Aref’s headquarters lifted a ban on executive agencies using foreign messaging platforms for official communications. By contrast, Article 3(c) of the draft bill requires those agencies to deliver electronic public services and official information through licensed domestic services.
Although the draft preceded the headquarters’ September decision, the two texts point in different directions, exposing the underlying disagreement over the government’s powers.
Article 8 raises the stakes further: executive officials who refuse to carry out the law’s requirements could face removal from public service or even imprisonment. The contest over who gets to “organize” or “systematize” cyberspace has moved well beyond administrative procedure.
The institutions the bill’s sponsors want to place at the center of internet governance are not new. Understanding their role requires returning to the three high commissions established during the Supreme Council’s first year.
The High Commission for Cyberspace Regulation
The first commission named in the bill, the High Commission for Cyberspace Regulation, was established on September 15, 2012. The Supreme Council created two other specialist commissions that year, covering security and content production.
Under its original mandate, the regulatory commission was responsible for policymaking, coordination and approval of overarching regulations across several areas, including security and content. The secretaries of the other two commissions also sat on it.
Its pivotal moment came with the Protection Bill. Successive versions of that proposal envisaged extensive powers for the commission, from appointing sector regulators and resolving disputes among them to managing network traffic and designing the internet’s regulatory architecture.
After widespread public opposition stalled the Protection Bill’s passage, the Supreme Council rewrote the commission’s mandate in April–May 2022. The resulting resolution gave it responsibilities beyond broad policymaking: appointing or establishing sector regulators, coordinating and overseeing their work, resolving disputes, and approving requirements for managing domestic and international network traffic.
Many of these powers had previously appeared in the Protection Bill.
The 2022 resolution nevertheless preserved two important exceptions. Cyberspace security regulation remained with the High Commission for Cyberspace Security. Decisions on content regulation by the regulatory commission were made conditional on proposals from the High Commission for the Promotion of Cyberspace Content Production.
Article 4 of the new Systematization Bill lists sector regulators and defines the high commissions’ coordinating roles, bringing this same multilayered architecture back into a parliamentary proposal.
The High Commission for Cyberspace Security
The High Commission for Cyberspace Security was established on October 13, 2012. Its original membership included representatives of the Ministry of Intelligence, the Islamic Revolutionary Guard Corps (IRGC), the police, the Armed Forces General Staff, the Prosecutor General’s Office and several executive agencies. The head of the National Cyberspace Center was appointed its chair.
Its founding resolution assigned it responsibility for protecting critical infrastructure, managing cyber threats, allocating security responsibilities, and organizing cyberspace security in both routine and crisis conditions.
Its subsequent remit extended beyond the technical security of networks. The Islamic Republic’s strategic cyberspace document, approved in July–August 2022, designated the commission as the authority for approving documents on a “cyberspace policing framework” and the regulation of political publicity, including election-related activities and online campaigns.
This places some online political and social activity within the state’s definition of cyberspace security, alongside the prevention of cyberattacks.
Even with a commission formally responsible for cyberspace security during crises, however, authority over certain internet security decisions has rested elsewhere. During the 2026 restrictions, government officials attributed decisions to shut down the internet to a working group affiliated with the Supreme National Security Council, rather than to orders from the security commission.
The High Commission for the Promotion of Cyberspace Content Production
The third body, the High Commission for the Promotion of Cyberspace Content Production, was established on December 1, 2012. Its original membership included representatives of the state broadcaster, the Islamic Development Organization, the religious seminary establishment, the IRGC, the Basij paramilitary organization, and the Ministry of Culture and Islamic Guidance.
Its founding resolution assigned it tasks such as supporting content based on the values of the Islamic Revolution, strengthening institutions and personnel committed to those values, and setting policy for “assessing and shaping audience preferences.”
The same resolution envisaged transferring responsibilities for organizing online content from the secretariat of the Supreme Council of the Cultural Revolution to the National Cyberspace Center. The commission therefore inherited elements of an institutional framework that predated the Supreme Council of Cyberspace itself.
More recent developments show its remit expanding from cultural policy into the economics of content production and distribution.
In January–February 2025, the Supreme Council approved “Policies and Requirements for Network Traffic Pricing and Content Revenue Sharing”. The document envisages collecting a share of operators’ revenue associated with international traffic and allocating it to the domestic content production chain.
Under the document, the content commission has a role in approving rules for allocating those resources and determining mechanisms for financially supporting content production. The stated goals are to strengthen domestic content and increase the share of domestic network traffic.
In August–September 2026, the National Cyberspace Center also announced that the content commission had approved a document on developing and regulating online commercial advertising. It said the document had been prepared over two years with the participation of the Ministry of Culture and other relevant agencies.
The Systematization Bill again identifies this commission, alongside the other two, as a higher-level regulatory authority. That position could consolidate its influence over platform operations and the digital content market.
Bringing Security and Content Back to the Center
Fourteen years after the Supreme Council of Cyberspace was established, the Islamic Republic still faces the problem the Council was supposed to solve: multiple decision-making institutions with conflicting powers.
The history of its three high commissions shows that the Systematization Bill goes beyond an attempt to resolve administrative disorder. It belongs to a longer process through which regulatory, security and content-related powers have gradually accumulated within institutions attached to the Supreme Council.
The Protection Bill never completed its passage as a legislative package, but parts of its institutional architecture were subsequently established through Supreme Council resolutions. The Systematization Bill now seeks to give elements of that structure a basis in parliamentary law.
At its center are two less familiar commissions: one responsible for security policy, the other for directing content production and its economic foundations. Their return to the heart of the regulatory structure makes the central question clear: who will hold the power to decide what people can access, how platforms can operate, and what content citizens see?