One of the most important resolutions affecting the structure and outlook of the development of the National Information Network, and the future state of the internet and digital governance in the Islamic Republic of Iran, is the “Macro Plan and Architecture of the National Information Network,” which was approved in 2020 by the Supreme Council of Cyberspace. This document, as the roadmap for network development in Iran, attempts to define the general framework, objectives, and technical, legal, and executive requirements related to the development and management of the National Information Network. In one section of this document, thirty objectives are listed for this network. In this list, the twenty-eighth objective is marked as “not publishable.”

However, after the cyberattack on the email server of the Cyberspace Deputy of the Prosecutor General’s Office, unique information was obtained about the details of the performance and development plans for the censorship and filtering system in the Islamic Republic of Iran, centered on the “Working Group for Determining Instances of Criminal Content” — the Filtering Committee. This body is the most important institution for internet censorship and filtering in Iran. The working group is composed of representatives from twelve institutions and operates under the Prosecutor General’s Office, through its Cyberspace Deputy.

Among these documents was a draft document titled “Regulations for the Use of the Ministry of Communications’ Eshraf System.” Article 1 of this draft states that the “Eshraf System over Cyberspace” is the subject of “Clause 2-2-1-28 of the Macro Plan and Architecture of the National Information Network, approved by the Supreme Council of Cyberspace.” This is the same twenty-eighth objective that, two years earlier, at the time of the publication of the Macro Plan and Architecture of the National Information Network, had been marked as “not publishable.”

This draft states that any type of “traffic data, including origin, destination, and date” of communications, as well as any type of “user information,” is stored and then, in cases where there is “strong suspicion of discovering a crime …,” may be provided to the “applicant” upon “obtaining an order from the judicial authority.” Based on these documents, what is expected from the operation of the “Eshraf over Cyberspace” system aligns with the system of “legal interception.” Therefore, for the first time, we have obtained a document that describes part of the operation of the legal interception system under the title “Eshraf System over Cyberspace.”

Although the main clause on the Eshraf System has not been published among the “objectives of the National Information Network,” this executive regulation also contains details that reveal the scope of this “information oversight.” For example, in Article 1, in describing the applicants who use the Eshraf System regarding users, it states:

“Judicial authorities, judicial officers — commanders, officers, and rank-and-file members of the Law Enforcement Force who have received judicial officer cards — … employees of the Ministry of Intelligence in the discovery of major economic corruption, and employees of the Islamic Revolutionary Guard Corps in missions subject to Articles 2 to 5 of the IRGC Statute and Clause 2 of Article 6 of the Law Establishing the Ministry of Intelligence, as judicial officers.”

Article 2 of the IRGC Statute refers to “struggle against the Islamic Republic,” which is a security offense. This issue shows the importance of the “Eshraf System” in the security system of the Islamic Republic. But the notable point is the Ministry of Communications’ oversight over “all” data exchanged in the country. Article 4 of the draft states:

“Regarding case-by-case inquiries into traffic data or user information, the applicant shall submit their request through the system to the judicial authority handling the case, with the relevant reasons and indications, and basic information such as source or destination IP, date, time, type of service, and destination website address. If the judicial authority agrees, the order to provide the requested data, in implementation of Article 670 of the Criminal Procedure Code, shall be registered through the system, and the response shall be automatically received from the system and provided to the relevant applicant.”

No further technical details about the “Eshraf” system, or the capability of “Eshraf over Cyberspace” within the National Information Network, are available. However, other evidence obtained from systems such as SIAM, Hamta, Shahkar, and others shows that the Ministry of Communications and Information Technology is developing infrastructures that enable the complete interception of citizens and the monitoring and surveillance of users’ traffic data, in accordance with resolutions that were approved two decades ago by the Supreme Council of the Cultural Revolution.