In October 2025 the Islamic Republic confirmed a sweeping new law that recasts a range of communications and technology activities as national-security crimes. Promoted by lawmakers as a tool to close perceived intelligence gaps exposed during recent confrontations with Israel, the statute expands the legal category of “espionage” to include certain uses of satellite internet and, unusually, names a commercial provider by brand. The measure transforms what had been a gray regulatory area into a penal regime that exposes ordinary users as potential defendants in national-security cases.
The statute, formally titled the Law on Aggravated Punishments for Espionage and Cooperation with the Zionist Regime and Hostile States, runs nine articles and seven annexes. Its provisions reach well beyond classic espionage: they criminalise a spectrum of activities described as “operational actions,” “information activities,” and, centrally, the possession, sale or use of certain satellite internet equipment. The law’s drafters state their objective as closing channels for foreign intelligence and hostile influence, but the text substantially lowers the threshold between routine communications and security offences.
A legal novelty in the text is Article 5, which addresses “satellite internet” explicitly and cites the Starlink system by name. That specificity is striking: penal codes usually avoid trade names in favour of functional descriptions. By singling out Starlink, Article 5 removes much of the legal ambiguity that can arise when courts attempt to map abstract offences onto new technologies. It also signals that the legislature sees the technology, not merely particular actors, as the problem to be regulated by criminal law.
Article 5 establishes a three-tier regime of culpability. At the lowest tier, private possession and personal use of satellite terminals are criminalised and subject to a custodial sentence (six months to two years) plus seizure of the equipment. At the middle tier, commercial activities, importation, distribution or installation of satellite kits, carry a heavier prison term (two to five years). At the highest tier, any use of satellite internet that the state interprets as “acting against the system” or as an “information action” on behalf of a hostile actor can attract long sentences or, in cases where the user is deemed an agent of an enemy, the death penalty with confiscation of assets. The statutory language makes intent and outcome determinative: the same device can trigger widely differing punishments depending on how prosecutors and security agencies characterise the user’s motive and the result of their actions.
That architecture produces two immediate legal effects. First, ordinary users who acquire satellite kits to access uncensored internet for work, education or personal reasons, can fall within the law’s ambit if their communications are later construed as hostile or routed to a state-designated “enemy” outlet. Second, interconnected provisions mean an otherwise minor offence (e.g., transmitting a short video to a foreign outlet) can cascade into far more serious charges: Article 4 criminalises sending material to “enemy networks” and is drafted broadly enough to include many forms of journalism and civic reporting. Together, the provisions create what critics call a “ladder of accusation” in which minor conduct becomes an entry point to national-security prosecution.
The law also reallocates significant interpretive power to security bodies. The SCC (Supreme Council of Cyberspace) is named as the authority for identifying “hostile states and groups” beyond the statute’s explicit list, while the Ministry of Intelligence is tasked with compiling and updating the roster of “adversarial networks, human-mediators and social pages.” Those delegations mean that decisions about whether a platform or outlet is “enemy” material will rest with executive agencies, rather than independent courts, an arrangement that lawyers warn undermines due process and widens the scope for politically motivated determinations.
Procedurally, the statute introduces expedited criminal procedures and a truncated appeals architecture for the designated offences. Cases are to be heard “out of turn” in specialised Revolutionary Court branches; statutory deadlines for many forms of notice and appeal have been reduced to ten days; and most convictions are declared final except for capital sentences. Judges are given expanded authority to extend pretrial detention and to order evidentiary supplementation ex officio. Human-rights advocates say those rules create a fast track from arrest to final verdict with reduced safeguards for defendants.
From a technical and policy perspective, the law marks a decisive shift from regulatory control to criminal prohibition. Nations facing the challenge of satellite internet have typically responded with spectrum rules, licensing regimes, import restrictions or targeted sanctions. Iran’s statute goes further: it enlists the criminal law as the primary instrument for managing a communications technology that bypasses national infrastructure. This choice reflects a strategic calculus, prioritising deterrence and punishment over accommodation, but it raises practical questions about enforcement and proportionality. Criminalising possession will not remove the global footprint of satellite constellations; rather, it will place users, smugglers and intermediaries at legal risk and push demand into clandestine markets.
The consequences for civil society and journalism are immediate and tangible. Journalists, researchers and human-rights monitors who rely on satellite links to communicate safely, document abuses, or reach audiences outside state control now face arrest, prolonged detention and, in extreme cases, capital charges if prosecutors attribute hostile intent. The law’s broad wording also risks chilling routine forms of civic expression: a citizen who shares footage of local unrest with an international broadcaster could be prosecuted not simply for the content but for the transmission method. Legal scholars argue that the net effect will be deeper informational isolation and reduced capacity for independent reporting inside the country.
Internationally, the law is certain to complicate the operations of technology providers and aid organisations. Commercial satellite operators routinely follow local laws where they have a presence, but a law that criminalises end-user possession and names a global brand presents novel liability questions. Non-governmental organisations that provide communications support in crises confront a stark choice: abstain, assist covertly at legal risk, or deploy alternative technical mitigations that may be less secure. For diaspora audiences and foreign newsrooms, the law creates more than a compliance headache; it converts routine newsgathering and relay activities into activities that could expose interlocutors inside Iran to severe penalties.
The statute’s critics, drawn from academia, legal practice and civil society, emphasise three interlocking problems. First is proportionality: extending capital punishment to categories of non-violent technological activity violates international norms and eliminates the space for measured regulatory responses. Second is legal certainty: the statute’s reliance on broad phrases such as “contrary to national security” invites ad hoc enforcement and politicised prosecutions. Third is due process: expedited procedures and the delegation of definitional authority to security agencies weaken judicial oversight and defendant protections. Those critiques have been formalised by legal signatories and echoed by international monitors who view the changes as a step toward criminalising dissent and independent information flows.
For policymakers and technologists, the law presents a policy conundrum: how to reconcile legitimate national-security concerns about foreign interference with the rights to free expression, access to information and proportionate legal remedies. Some modest, practicable alternatives exist, licensing, conditional authorisations with technical controls, and transparent, judicially supervised mechanisms for identifying hostile actors, but they require institutions willing to prioritise regulation and oversight over penal intimidation.
The new law makes clear that the Islamic Republic’s approach is different. It treats certain communications technologies as existential threats and empowers security organs to use the criminal law as their principal instrument. The result is not merely a regulatory tightening but a legal architecture that, by design, shifts many ordinary forms of technological engagement into the orbit of national-security prosecution. For users, journalists and service providers, that shift will shape choices about access, reporting and aid for years to come.